The invention relates to a method for granting an inquirer querying a repository access to the repository, a communication protocol between a client and a server, and a system for controlling access of at least one inquirer to a repository. The repository typically stores event data relating to traceable products. The aspects according to teaching disclosed herein may be for example implemented as security extensions for existing repositories providing a finer granularity of access rights and means to prevent an exposure of data sets considered sensitive. The security extensions disclosed herein may be implemented to protect access to any kind of client/server application wherein the server is exposing sensitive data.