1. A method, comprising: querying for a data context in connection with potential access to one or more computing objects of a computing system by at least one computing device on behalf of a user identity; receiving the data context in response to the query; in response to receiving the data context, defining a derived role for the user identity relative to the one or more computing objects based on at least one aspect of the data context; receiving, by the at least one computing device, a request for access to at least one computing object of the one or more computing objects, the request for access on behalf of the user identity; evaluating a control expression of an object governing access to the at least one computing object based on the derived role to form a set of permissions; and granting access to the at least one computing object if the set of permissions includes a permission for the request for access.