Controlling resource access, a first device responsive to a request for access to a resource, determines whether to grant the access to the resource, based on an identity of a requestor requesting the access to the resource. The resource is provided by a second device that is separate from the first device. The first device customizes an access token with an access constraint to control the access to the resource, the access token is generated responsive to the first device determining that, based on the identity of the requestor requesting the access to the resource, the access to the resource is granted.