A cloud resource protection method, system, and computer program product include authenticating a user on a first computer that is part of a distributed system, based on the authentication, assigning to the user, on the first computer, a token indicating a set of permissions, receiving a directive from the user to initiate, via the first computer, the execution of a process associated with a class, based on the token, initiating, on a second computer, the execution of the process, with no further authentication, granting the process access to a data set, access to which is restricted to one or more of the plurality of classes, and providing a data item from the data set to the user.