Abstract: Aspects of the subject matter described herein relate to determining effective policy when more than one policy may be associated with an entity. In aspects, bindings associate policies with target groups that may include one or more entities. The bindings are ordered by precedence. When properties of two or more policies affect an entity, properties of policies in higher precedence bindings control (e.g., override) properties of policies in lower precedence bindings. When a property of a policy is not included in other policies that affect an entity, the property is retained. A policy resolver determines disjoint target groups and a resultant policy associated with each disjoint target group. The resultant policy associated with a disjoint target group represents a combination of the original policies according to precedence.

Abstract: Dynamically associating an attribute and an associated value to an object includes dynamically associating attribute-value sets to an object, but is not so limited. An exemplary system includes a directory component that can be configured to dynamically assign different values, for a set attributes, to an object. An exemplary directory application can be configured to select an attribute-value set for an object based in part on a group membership determination, and a precedence parameter associated with an attribute-value, set, or other grouping. Other embodiments are available.

Abstract: Aspects of the subject matter described herein relate to determining effective policy when more than one policy may be associated with an entity. In aspects, bindings associate policies with target groups that may include one or more entities. The bindings are ordered by precedence. When properties of two or more policies affect an entity, properties of policies in higher precedence bindings control (e.g., override) properties of policies in lower precedence bindings. When a property of a policy is not included in other policies that affect an entity, the property is retained. A policy resolver determines disjoint target groups and a resultant policy associated with each disjoint target group. The resultant policy associated with a disjoint target group represents a combination of the original policies according to precedence.

Abstract: Embodiments are provided to dynamically associate an attribute and an associated value to an object, including attribute-value sets to an object, but the embodiments are not so limited. In an embodiment, a system includes a directory component that can be configured to dynamically assign different values, for a set attributes, to an object. In one embodiment, a directory application can be configured to select an attribute-value set for an object based in part on a group membership determination, and a precedence parameter associated with an attribute-value, set, or other grouping. Other embodiments are available.