A system and machine-implemented method for providing secure access to an object, the method including receiving an indication of a request from a first entity to share access and delegation rights to a second object with a first object, the second object having a corresponding access control list (ACL) including a listing of one or more authorized entities having access to the second object including the first entity, generating a token representing access and delegation rights of the first object with respect to the second object and providing the token to the first object, adding a token identifier (ID) corresponding to the token to the ACL of the second object, such that the first object is added to the authorized entities having access and delegation rights to the second object.