Evidence-based security policy manager

(57) The policy manager of a summary base of evidence generates the permission grant set about the code assembly received from the resource location. Policy managers are a check module of run time environment, and combination with a class loader, and are performed in a computer system (for example, a Web client or a Web server). It helps to judge whether the permission grant set generated about the code assembly is applied in a run time invocation stack, and the given system action according a system to a code assembly is permitted. Both a code assembly and proof are received from a remote resource location through a local origin to a network (for example, Internet). An execution module for a policy manager to analyze the syntax of security policy specification, The execution module for generating one or more code classes, and the execution module for evaluating the member ship of the received code assembly in one or more code groups, It is possible for the execution module for generating a permission grant set based on this member ship evaluation to be included. The policy manager can generate two or more policy levels according to the security policy definition specified in security policy specification. The permission from each policy level can be merged, the permission grant set relevant to a code assembly can be generated, and it can apply in the run time invocation stack of an execution thread.