Accessleaf

Accessleaf is a framework for managing access permissions in distributed systems. It models permissions as leaves in a hierarchical policy tree, where each leaf represents a concrete right to perform a specific action on a resource. The design emphasizes least privilege, revocability, and auditable usage, enabling fine-grained access control across services, APIs, and storage assets.

In operation, a central or delegated authority issues leaf tokens that encode the resource identifier, allowed actions, constraints, and a validity period. Resource gateways and services validate the token against a revocation registry and the policy tree before granting access. When access is no longer permitted, the leaf is revoked and the token becomes invalid, with rapid propagation through the network.

Accessleaf provides components such as a policy tree engine, a revocation registry, and adapters for identity providers (OIDC, SAML) and cloud IAMs. It supports interoperability through a standard REST/JSON API and aims to integrate with existing access control models, including capability-based and attribute-based approaches. Security considerations include secure token storage, protection against token leakage, and timely revocation.

Origins and usage: The concept arose in academic and practitioner discussions around the 2020s as a way to combine capability-based security with hierarchical policy modeling. It is described primarily in technical articles and pilot implementations rather than as a widely standardized protocol. Adoption remains limited to experimental or specialized environments.

See also: access control, capability-based security, attribute-based access control, token-based authentication, policy engines.