The authorization runtime client 508 may allow or deny 554 access for the resource specified by ResourceURN by the customer 502. If access is denied, the provider web services 514 may return 556 an indication that access is denied. If access is allowed, the provider web services 514 may return 556 the resource or access to the resource specified by ResourceURN to the customer 502. Note that, depending on implementation, steps of the process 500 may be performed in a different order, even in parallel, with more or fewer steps from those depicted in FIG. 5. Further, the process 500 may be performed using more, fewer, or different entities than those depicted in the illustrative example.
FIG. 6 illustrates an aspect of a system 600 in which various embodiments may be practiced. Specifically, the system 600 is an example of a system usable to perform the process 500 of FIG. 5. As illustrated in FIG. 6, the system 600 may include a client 602, which may communicate to a web resource service 614. The web resource service 614 may communicate to a resource container service 606 comprising a resource container client 610 and an authorization runtime client 608. The resource container service 606 may communicate with a platform data store 612.