Methods and apparatus for access control in service-oriented computing environments