Access control system and access control method

An access control system which controls user access to a resource, comprising:

• at least one processor;
• and
• at least one storage device which stores information defining conditions under which each user is allowed to perform resource access,
• wherein the at least one processor acquires a first access request indicating an operation for a first resource in a target system by a first user,
• determines based on the information whether or not the first access request is permitted,
• acquires a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and
• grants execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission.