1. An apparatus comprising: a memory operable to store a plurality of tokens, wherein the plurality of tokens comprises a plurality of risk tokens, each risk token representing a risk rating, the risk rating being a numerical value indicating a risk associated with granting a particular user access to a particular resource; a processor operable to: identify a set of related risk tokens in the plurality of risk tokens; generate a composite risk token that represents an arithmetic combination of the risk ratings represented by the set of related risk tokens; and use the composite risk token to facilitate the making of an access decision.