> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/security/authorization/access-requests-grants.md).

# Access Requests and Grants

Inrupt's Enterprise Solid Server (ESS) supports an authorization mechanism based on Access Requests and Grants. With Access Requests and Grants:

1. An [agent](/reference/glossary.md#agent) sends an Access Request to the [resource owner](/reference/glossary.md#resource-owner) . In ESS, the Access Request is serialized as a [VC](/reference/glossary.md#verifiable-credential). This request includes the specific [access mode](/reference/glossary.md#access-modes) (e.g. **`Read`** , **`Write`** , **`Append`** ), the resources to access, the purpose the data will be used, etc.
2. The resource owner decides to deny or grant the Access Request:

* For an approved request, ESS creates an Access Grant with an approved status.
* For a denied request, ESS creates an Access Grant with a denied status.

  \
  In ESS, the Access Grant is serialized as a VC, and the resource owner can revoke the Access Grant in the future.

3. Once the resource owner approves the Access Grant, the requesting agent can retrieve the resource with a direct HTTP request using their [ESS Access Token](/security/authentication.md#ess-access-token). The Access Grant is a receipt — ESS checks the grant server-side when the agent makes the request, so no additional token exchange is needed.

Note:

* An Access Request for a [Container](/reference/glossary.md#container), by default, also applies to the Container’s descendants, unless explicitly specified otherwise in the request (See [inherit: false](https://docs.inrupt.com/ess/latest/services/service-access-grant/) ).
* An Access Grant for a Container, by default, also applies to the Container’s descendants, unless explicitly specified otherwise in the grant (See [inherit: false](https://docs.inrupt.com/ess/latest/services/service-access-grant/) ).

### Access Grant Effective Period

An active (i.e., not revoked) access grant is effective:

* Starting from its **`issuanceDate`** to its **`expirationDate`** , and
* While its **`credentialSubject.id`** (the grantor) remains a resource owner .

### Services to Support Access Requests and Grants

To support access requests and grants, ESS provides the following services:

* [Access Grant Service](https://docs.inrupt.com/ess/latest/services/service-access-grant/). The Access Grant service is responsible for issuing, verifying, and revoking Verifiable Credentials.
* [Authorization Service](https://docs.inrupt.com/ess/latest/services/service-authorization/) to manage the ACPs.