A computer implemented method for access control for a consumer accessing a restricted resource in a network connected computer system, the method including receiving a continuous sequence of data records relating to use, by the consumer, of the restricted resource, the resource being accessed by the consumer over an access network; continuously comparing the data records with an access control policy for the restricted resource; in response to a determination that the behavior is non-compliant with respect to the policy, generating and communicating a shared secret to the consumer, the shared secret being communicated via a communications channel other than the access network; receiving a response to a challenge from the user via the access network; and notifying the computer system that access to the resource by the consumer should be precluded based on a comparison of the response to the challenge and the shared-secret.