&quot;Using cryptography&quot; is (like some of the other things mentioned) nice in theory, but has significant drawbacks as well.<p>If you&#x27;ve ever worked with stateless servers using something like JWT, you will have run into the issue of &#x27;stale data&#x27;, essentially the cache invalidation problem. Trying to solve ACLs with cryptography is prone to the exact same issues, as well as overhead problems. The crypto itself is immutable.<p>EDIT: In fact, Git is a great example of how you <i>can&#x27;t</i> really do access control very easily in such a setup. Have you ever tried restricting access to a specific branch in a repository?