A computer-implemented method includes receiving a request for access to a micro-service for a subject to perform an action using a resource; determining whether an access policy governing the access for the subject to perform the action using the resource is stored in a cache memory; in response to the access policy being stored in the cache memory, allowing or denying the request based on the access policy; in response to the access policy not being stored in the cache memory, requesting a new access policy for the subject to perform the action using the resource; receiving the new access policy including an access decision and a duration of the new access policy; allowing or denying the request based on the new access policy; and storing the new access policy in the cache memory.