The state-of-the-art review comprehensively examines access control mechanisms for securing cloud computing environments, emphasizing their architectural evolution and performance efficiency. Conventional access control models such as Role Based Access Control (RBAC) and Attribute Based Encryption (ABE), though widely adopted, continue to face limitations including single points of failure, centralized policy management, and limited transparency in audit trails. Recent studies report average encryption and decryption times below one second in conventional schemes, yet these models struggle with scalability and dynamic revocation in distributed settings. The integration of blockchain technology addresses many of these challenges through its decentralized, immutable, and transparent infrastructure. Blockchain based access control frameworks implemented on platforms such as Hyperledger Fabric and Ethereum leverage smart contracts to automate policy enforcement and achieve throughput gains of up to 42 percent with transaction latencies near 39 milliseconds. By distributing trust and enabling verifiable audit trails, these models enhance data integrity, accountability, and compliance. This survey consolidates and analyzes current research in both conventional and blockchain based access control for cloud and IoT ecosystems, identifying performance tradeoffs, regulatory considerations, and future research directions toward secure, transparent, and scalable access management.
Marwa Ali Hamdan AL-Jabri, Nafisa Abul Ghafoor Othman AL-Ansari
Access control is an important part of cybersecurity in distributed systems since conventional centralized mechanisms are not always sufficient. Due to blockchain, individuals have begun to employ decentralized access control models as they are capable of enhancing transparency, auditing and defending against fraud. At the reason of this report, we survey various blockchain-based access control systems, paying special attention to their architectures, confirmation mechanisms, identity models and policy enforcement mechanisms. We categorize the current literature into various groups based on their platforms (e.g. Ethereum, Hyperledger, Fabric), control mechanisms (e.g. RBAC, ABAC and capability-based) and whether they introduce additional privacy-tools such as zero-knowledge proofs and decentralized identifiers. The paper analyzes and describes the key gaps in current frameworks in terms of scalability, interoperability and computing expenses. Then, the shortcomings of the current research are pointed out so that they could guide future efforts in the field of blockchain-based access control systems.
An effective healthcare data system must safeguard individual privacy, foster public trust, and enhance societal resilience. To achieve this, access to critical health information must be provided in an ethical, secure, and reliable manner. This paper proposes a blockchain-based healthcare management framework designed to improve security, privacy, and transparency in healthcare administration. The architecture incorporates smart contracts, multi-signature wallets, and zero-knowledge proofs (ZKPs) to securely facilitate key operations such as patient registration, policy updates, and medical device management on a decentralized platform. Multi-signature wallets require authorization from multiple stakeholders for sensitive transactions, while ZKPs enable identity or access verification without disclosing confidential information. A built-in performance monitoring module collects key metrics, including transaction latency, gas consumption, and block time, which are visualized using JavaScript. Overall, the proposed system offers a secure, transparent, and privacy-preserving approach to decentralized healthcare management.
We present a game semantics framework for open-world safety analysis of Ethereum smart contracts. We model the interaction between a contract and its environment as a two-player game between the contract and the environment, and prove up to gas model approximations soundness: every assertion violation found corresponds to a real execution; and completeness: every open-world execution is captured. To our knowledge, this provides the first formal open-world interaction semantics for Ethereum smart contracts with mathematical guarantees of soundness and completeness. We implement this framework in YulTracer, an assertion reachability tool for real-world Solidity contracts, built on Yul, the intermediate language of the Solidity compiler. YulTracer uses concrete execution and exhaustively explores game traces within user-specified bounds. We evaluate it on reentrancy benchmarks, where YulTracer achieves 100% recall and precision -- the only tool to do so from those we examined -- and on two large real-world exploits (the DAO and PredyPool), where it detects the known vulnerabilities and produces no false positives on fixed versions. To our knowledge, YulTracer is the first tool to achieve this level of precision on real-world contracts without false positives. We additionally demonstrate generality of the approach via the examination of access control benchmarks.
Liaqat Ali, Ahmad Alshamayleh, Amer Ibrahim, Syed Muqtar Ahmed
Cloud technologies have dramatically altered the data storage, access, and scalability landscape, but the resultant dependence on centralized systems creates immense challenges for security, privacy, and unauthorized access. This paper introduces a new framework for enabling information management in cloud environments using blockchain-enabled secure access control. By integrating distributed ledger technology and highly cryptographic access control methods, this framework will facilitate immutable record-keeping, real-time verification of access rights, and the ability to audit user activity. This framework will substantially reduce the risk of data breaches, insider threats, and unauthorized access through its transparency and overall operational reliance. The empirical evaluations confirm that blockchain-enabled access control provides an impressive level of security, while smoothing information management processes and establishing trust and resilience in cloud environments. The results will demonstrate that blockchain can disrupt cloud information management and provide a scalable, privacy-preserving solution for any enterprise or multi-tenant cloud application.
Qaisar Manzoor, Ch Anwar Ul Hassan, Ali Daud, Azhar Imran
In order to effectively follow up with a patient, it is essential to have a health record. The opinions, prescriptions, research, and any other data connected to the patient that are provided by medical professionals are included in this document. An individual or individuals, such as the patient, the physician, and the chemist, are taking part in the process of exchanging and managing this file. Those individuals who are authorized to do so are able to view the electronic health record (EHR) from any location, and the information contained inside the EHR is distributed across various health care providers. Under some conditions, such as those pertaining to privacy and security, the electronic health record (EHR) must be shared. On the other hand, the existing health care systems may be susceptible to system failures and hacking, which makes it difficult to deliver services that can be relied upon. Additionally, the characteristics of such systems make it difficult to exercise centralized control over admission requirements. The findings of this study propose a strategy that Ethereum may implement to promote the trading of EHR models. Ethereum allows for the addition of EHR partners to the route, which makes it simpler for individuals to communicate data with one another. Users are given the ability to decide how data can be accessed using attribute-based access control (ABAC), which may result in the system becoming more secure. It is possible to view any record that has been preserved on the blockchain by utilizing the Ethereum Fabric feature; however, the record cannot be altered or removed. This ensures that the data can be traced back to the specific source from which it originated. By utilizing proxy re encryption, which guarantees that data will not be disclosed while it is being shared, it is possible to guarantee the safety of the data.
Agentic AI platforms launch short-lived software agents that act with delegated authority across services and organizations. Existing authentication protocols were designed for traditional web applications and long-lived microservices, not ephemeral autonomous agents, creating uncertainty about their applicability to agentic scenarios. This paper systematically analyzes authentication mechanisms for agentic ecosystems, including SPIFFE/SPIRE for workload identity, OAuth 2.0 and OpenID Connect for user delegation, Token Exchange for delegation chains, DPoP for sender-constrained tokens, CIBA for human step-up, and decentralized identity approaches for cross-domain portability. We propose a five-pattern taxonomy organizing these mechanisms by interaction type: user-to-agent, orchestrator-to-agent, agent-to-internal service, agent-to-external API, and cross-domain federation. For each pattern, we evaluate capabilities and limitations based on specifications and implementations, identify integration prerequisites, and highlight operational challenges. To validate the feasibility of protocol composition, we implement a hybrid prototype that demonstrates agent-to-internal-service authentication. Measurements show that sender-constrained tokens add 52ms of cold-path and 11ms of warm-path overhead, with token caching providing a 4.6× speedup. Our analysis indicates that protocol compositions can address core agentic requirements (ephemerality, delegation, replay prevention, auditability) within a single trust domain, while identifying critical research gaps, including multi-hop delegation semantics, federation automation, and high-churn performance.
Conventional authentication techniques, such as one-time passwords and passwords, are extremely susceptible to data breaches, credential theft, and phishing attacks. These vulnerabilities are increased when using shared or public devices. This paper proposes a password-less authentication architecture for various environments and organization based on Zero-Knowledge Proofs in order to overcome these issues. The proposed model ensures that no sensitive credentials are sent or retained by having a user demonstrate that they possess a secret without disclosing it to the server. In doing so, the attack surface linked to traditional login methods is greatly reduced. The framework is meant to be scalable, lightweight and easy to integrate with learning management systems, corporate sites, online test platforms, and university websites.
Identity management is a critical component in egovernance, ensuring secure, reliable, and efficient verification of citizens' identities. With increasing digitization, protecting personal data while enabling seamless access to government services has become essential. Existing identity management systems often rely on centralized databases, which are prone to data breaches, unauthorized access, and lack of transparency, raising concerns over privacy and trust. To address these challenges, this research proposes a Blockchain Identity Framework that integrates Zero-Knowledge Proof (BIF-ZKP) authentication with blockchain consensus mechanisms. In this framework, ZKP enables users to prove their identity without revealing sensitive information, while blockchain ensures that identity records are decentralized, tamperproof, and auditable. The consensus mechanism guarantees that all identity transactions are verified by multiple nodes, reducing the risk of fraud and unauthorized modifications. The proposed method is applied in an e-governance context to securely manage citizens' digital identities, enabling authentication for services such as online voting, tax filings, and social welfare schemes while maintaining privacy. Experimental evaluation demonstrates that the BIF significantly enhances data security, privacy preservation, and trustworthiness compared to traditional centralized identity systems. It reduces the risk of identity fraud and ensures the verifiable and transparent management of citizens' information. The proposed method improves data security by 96.2 % and reduces fraud by 89 %.
ABSTRACT Phishing attacks in decentralized Web3 systems continue to evolve beyond the detection capabilities of traditional Web2 security models. Existing decentralized authentication systems typically lack either mutual verification or dynamic threat awareness. We present PhishGuard++, a cross‐chain, privacy‐preserving authentication framework that introduces two core innovations: (1) a novel mutual Zero‐Knowledge Proof (ZKP) protocol that validates both users and services using Decentralized Identifiers (DIDs), and (2) a real‐time, on‐chain Graph Neural Network (GNN) threat oracle that assigns phishing risk scores integrated directly into smart contract‐based access control logic. A stake‐based validator reputation system with anti‐collusion incentives further reinforces trust without sacrificing decentralization or privacy. Experimental results on a simulated Arbitrum testnet show a statistically significant 40.4% reduction in phishing success rate across five attack vectors, 98.6% authentication accuracy, and sub‐second latency with gas‐efficient operations. Unlike prior works that independently apply ZKPs, DIDs, or GNNs, this framework offers the first privacy‐preserving, mutual authentication system that combines these technologies with stake‐based economic enforcement and real‐time smart contract enforcement. The novelty lies in the architecture's real‐time threat‐aware access decisions, validator‐linked risk accountability, and practical cross‐chain deployment—an integration not previously achieved.
Decentralization is a critical security property for blockchain systems. Ethereum adopts a protocol design with multiple incentive mechanisms to encourage validators to contribute to decentralization. However, little empirical evidence exists on the actual effectiveness of Ethereum's incentive mechanism. In this paper, we collect and analyze data on validator rewards from Ethereum's consensus and execution layers, examining both the distribution of rewards and the degree of decentralization in the current network. Our findings show that Ethereum's reward allocation exhibits a relatively balanced distribution, with neither staking pools nor exchanges earning disproportionately higher returns simply due to their larger stake. These findings reveal the effectiveness of Ethereum's incentive design and the current state of decentralization, providing a foundation for future improvements in mechanism design and exploration.
Modern digital ecosystems rely heavily on Open Source Software (OSS), but maintaining license compliance is still a major and unsolved problem. Current approaches rely on either manual audits, which are expensive, sluggish, and prone to error, or automatic scanners, which frequently fail with dual or bespoke licenses. Businesses, entrepreneurs, and academic institutions are exposed to serious legal, financial, and reputational concerns as a result of this divide. This project suggests a multi-layered OSS License Verification Framework that incorporates human-in-the-loop learning, logical reasoning, evidence-based validation, provenance tracking, and cryptographic assurance in order to overcome these constraints. To establish technical ground truth, the system starts with SBOM and SPDX provenance data, builds an attestation graph, and uses binary inference and differential tracing. License requirements are represented as vectors of obligations, assessed using a constraint solver and validated using zero-knowledge proofs (zk-proofs) to give auditors reliable proof of compliance. A human oracle ensures adaptation to changing license ecosystems by resolving ambiguities and continuously enhancing the knowledge base. The suggested framework seeks to provide an end-to-end, intelligent, and auditable solution for OSS licensing compliance by fusing automation with verifiability and adaptability. The results will help a variety of stakeholders, such as businesses looking to reduce risk, startups seeking quicker innovation, and academic institutions using OSS responsibly, all of which will contribute to a more secure and reliable opensource ecosystem.
Traditional zero trust architectures (ZTA) rely on centralized policy engines and mutable audit logs, creating single points of failure and limiting forensic integrity. We present a novel blockchain-secured zero trust network architecture that integrates distributed ledger technology, machine learning-based threat detection, and zero-knowledge proof authentication to eliminate the se limitations. Our five-layer framework comprises a user access layer, a zero-trust core (policy engine, administrator, and enforcement points), a blockchain security layer (smart con- tracts, consensus engine, and audit trail), a decentralized identity layer (W3CDIDs and zero-knowledge proof authentication), and protected network resources. Access requests are validated via zero-knowledge proofs; trust scores are computed dynamically using Random Forest classifiers achieving 96.3% accuracy; policy decisions are executed through Practical Byzantine Fault Tolerance (PBFT) consensus; and all security events are recorded immutably on Hyperledger Fabric. Smart contracts create automated incident response, which isolates malicious parties in less than 500 ms without human interference. Experiments on a 50-node testbed during simulated attacks show an authentication latency of < 100 ms, a throughput of > 1,000transactions per second (TPS), a threat-detection accuracy of > 95%, and a false-positive rate of < 5%. Our solution reduces the latency by 30% and the operating overhead by 60% and offers 100% integrity of the audit trail compared to traditional zero-trust implementations. This publication represents the first end-to-end integration of blockchain and zero-trust systems, providing a privacy-preserving, scalable, and resilient security architecture for enterprise environments and next-generation networks.
Existing agent communication frameworks face critical limitations in providing verifiable audit trails without compromising the privacy and confidentiality of agent interactions. The protection of agent communication privacy while ensuring auditability emerges as a fundamental challenge for applications requiring accurate billing, compliance verification, and accountability in regulated environments. We introduce a framework for auditing agent communications that keeps messages private while still checking they follow expected rules. It pairs zero-knowledge proofs with the existing Model Context Protocol (MCP) so messages can be verified without revealing their contents. The approach runs in lightweight networks, stays compatible with standard MCP exchanges, and adds asynchronous audit verification to confirm format and general message types without exposing specifics. The framework enables mutual audits between agents: one side can check communication content and quality while the other verifies usage metrics, all without revealing sensitive information. We formalize security goals and show that zk-MCP provides data authenticity and communication privacy, achieving efficient verification with negligible latency overhead. We fully implement the framework, including Circom-based zero-knowledge proof generation and an audit protocol integrated with MCP's bidirectional channel, and, to our knowledge, this is the first privacy-preserving audit system for agent communications that offers verifiable mutual auditing without exposing message content or compromising agent privacy.
In this paper, I prove that sublinear regret across the environment Class C requires six functional properties, that these properties are mutually independent, and that they compose into a directed informational chain closing back on itself — a six-link cycle whose final link is grounded in an explicit Doob martingale construction over cycles of play. All six properties are defined functionally — as conditions on the distributions a decision-maker induces over actions and canonical summaries — so the results are invariant under implementation and apply to any decision-making system that can be modelled within the class: a person, an institution, or a machine. Every theorem in this paper, without exception, is checked line by line in the Lean 4 proof assistant against Mathlib: the formalization (~12,700 lines) contains zero `sorry`, zero custom axioms, and zero opaque definitions. Class C is the union of all POMDPs satisfying at least one of six structural properties covering the fundamental qualitative dimensions of adaptive hardness: reward ambiguity (P1), absorbing traps (P2), local optima (P3), deterministic optimality (P4), constrained feasibility (P5), and nonstationarity (P6). * Part I (Necessity). I define six primitives X1–X6 as purely functional properties of decision rules: Objective Tracking, Cross-Context Safety Transfer, Global Attractor Exploration, Policy Simplification, Feasibility Projection, and Feedback Adaptation. For each, I construct an explicit environment in C and prove an unconditional Ω(T) regret lower bound for any decision-maker lacking that primitive.* Part II (Independence). For every ordered pair (i,j) with i≠j, I exhibit an explicit decision rule possessing Xj but lacking Xi that suffers Ω(T) regret on the matching environment. All thirty directed-pair results are shown to follow from one master theorem, verified on a single compound environment with full non-interference analysis.* Part III (Sequential Dependence). Necessity is domain-invariant — a structural failure is a structural failure no matter what "success" means to the decision-maker — which is why Parts I and II hold unconditionally. Sufficiency is not: what counts as success is supplied by the domain, not by the theorem, so a single closed-form sufficiency result covering every domain at once would have to either fix one arbitrary notion of success and stop being general, or say nothing of substance. Part III proves exactly what generalizes. I prove six Information Enhancement Theorems establishing that the six primitives compose into a directed information chain: possessing Xi strictly increases the mutual information available toward any goal variable at Xi+1's task. Each of the six links is established outright — a forward theorem, a reverse theorem, and a non-reversibility result — with the exact point where a domain's own definition of success enters the chain named explicitly, as an Implementation Obligation, rather than assumed away. The closing link, X6→X1, is grounded in an actual Doob martingale construction: given that the cycle-indexed posterior is a martingale, it converges almost surely to the truth across cycles — the precise sense in which the chain accumulates rather than resets. To this paper's knowledge, no prior formalization unifies this many independently-proven-necessary structural properties into a single machine-checked class with proven mutual independence across all of them. All mathematical work is provided in full transparency and independent verification is highly encouraged: the complete Lean formalization, with a passing build and every theorem cross-referenced to its exact identifier, is at github.com/M-Ismail-ZA/IsmailsPrimitives. For any feedback or collaboration, please contact me via the email address listed on the paper. Updated: 3 July 2026 (V6.1).
National identity systems require efficient, equitable decision-making that safeguards personal data. This article proposes a Self-Sovereign Identity (SSI) architecture, supported by a Verify-Without-Reveal (VWR) framework, designed for national-scale implementation. SSI places credentials in a citizen wallet and enables selective disclosure and zero-knowledge proofs, so services can verify attributes without seeing underlying records. VWR adds the policy and accountability spine: yes/no attribute APIs for holder-absent cases, purpose-bound and zero-trust enforcement on every call, and an immutable audit layer on a permissioned ledger. The study synthesises current standards and leading implementations in Europe and worldwide and formulates a deployable blueprint with clear roles, consent and lawful-override flows, per-agency pseudonyms, and regulator and citizen visibility. The study outlines reference APIs, user experiences for wallets and verifiers, and performance metrics suited for national workloads. Privacy-preserving AI strengthens biometric liveness, fraud detection, and anomaly response without centralising sensitive data. The framework aligns with GDPR data minimisation and purpose limitation, supports the European Digital Identity Wallet, and meets high-risk AI governance requirements. Results show how SSI proofs and VWR controls reduce unconsented disclosure and cross-agency browsing, while keeping latency low and interoperability high. The contribution is both conceptual and operational: a phased migration path that turns verify-without-reveal into the default mode for government and regulated services, improving security, inclusion, and public trust.
Access to digital services requires entities, such as users or software services, to establish their identities before interacting with service providers. Conventional identity management systems typically maintain separate identity records for each application, often resulting in multiple accounts for the same entity within a single service provider. When identical personally identifiable information and attributes are reused across platforms, these fragmented records can be correlated, increasing the risk of identity exposure and privacy breaches. This work presents an entity-centric identity management model tailored for cloud environments, designed to enhance privacy and reduce unnecessary information disclosure. The proposed approach is founded on two core components. The first is anonymous identification, which enables entities to interact with cloud services based on predefined privacy preferences without revealing their true identities. The second component introduces active bundles, which encapsulate personally identifiable information, usage policies, and an embedded execution environment responsible for enforcing privacy constraints. These bundles autonomously apply protection mechanisms to safeguard sensitive data, even when deployed on untrusted platforms. The proposed model offers several advantages, including reduced dependence on external identity providers, controlled disclosure of identity attributes to service providers, and secure utilization of identity data in untrusted cloud environments. By integrating privacy-enhancing technologies such as zero-knowledge proofs, the framework provides a robust and flexible solution for privacy-aware identity management in modern cloud-based systems.
Abstract Background: Healthcare organizations face unprecedented challenges in maintaining process compliance due to increasingly federated data and systems topologies, coupled with complex state, federal, and jurisdictional regulatory compliance and verification requirements. The emergence of distributed ledger technology (DLT) and artificial intelligence presents both transformative opportunities and significant compliance challenges. These emerging technologies enable computing paradigms that shift toward data locality models where computational models meet the data rather than moving sensitive patient information across organizational boundaries. This computational approach offers innovative pathways to mitigate data breach risks, while simultaneously introducing new verification complexities as the underlying technologies continue to advance: healthcare entities must cryptographically prove that operations performed on locally-held data were executed according to approved specifications while enabling selective disclosure capabilities across entity lines. However, traditional verification mechanisms lack the cryptographic guarantees necessary for these privacy-preserving, multi-entity healthcare workflows, creating substantial risks in clinical decision-making, patient privacy, and regulatory adherence. Objective: This paper introduces the ZK-PRET Business Process Prover framework that integrates Object Management Group (OMG) business process standards with zero-knowledge cryptographic verification to enable privacy-preserving healthcare process compliance across distributed systems. Methods: We developed a multi-layer architecture combining formal business process modeling, zero-knowledge proof generation, and regulatory compliance verification. The framework extends established OMG standards with cryptographic verification capabilities to achieve verifiable compliance, privacy preservation, and regulatory accountability. Implementation testing was conducted in synthetic data environments designed to represent real-world healthcare scenarios.¹ These environments enable comprehensive modeling and testing of multi-entity process orchestration patterns while maintaining privacy protections essential for healthcare research and development. All scenarios, clinical examples, and process expressions presented in this paper utilize synthetic data to ensure no real patient data, clinical records, or identifiable health information was used. Results: The ZK-PRET Business Process Prover framework demonstrates practical applicability across many healthcare domains including treatment planning, telemedicine coordination, healthcare administration, consumer health services, multi-entity clinical trials, and supply chain management. Implementation results demonstrate cryptographic verification capabilities that enable mathematical prevention of regulatory violations rather than post-hoc detection. The results demonstrate configurable privacy preservation through zero-knowledge verification and consistent proof sizes suitable for modeling complex orchestrations, while leveraging already widely used Web 2 process models, suitable for multiple runtime deployment topologies. Conclusions: Zero-knowledge healthcare process verification represents a foundational technology for regulatory compliance in distributed healthcare systems. While agentic AI systems present important opportunities for automation, the underlying requirement for verifiable process compliance through cryptographic means brings broader challenges. ZK-PRET Business Process Prover addresses these challenges in healthcare transformative flows, enabling safer deployment of autonomous systems while maintaining regulatory standards.
Rollups are central to blockchain scalability, but their governance is still evolving. Existing voting models risk capture by large stakeholders or inactive delegates. This paper introduces RepRoll, a governance model that uses delegated reputation scores backed by verifiable activity logs. Reputation grows through provable contributions: fraud-proof submissions, code audits, uptime guarantees, and community moderation. These contributions are recorded through a decentralized attestation layer similar to optimistic verification. Votes in protocol upgrades weigh both token stake and reputation, reducing plutocratic influence. A simulation of 10,000 participants demonstrates that RepRoll improves proposal quality and reduces governance attacks. We deploy a prototype on an Ethereum Layer-2 testnet, showing low on-chain overhead. The paper discusses vulnerabilities such as collusion, reputation laundering, and sybil amplification, and proposes cryptographic mitigations.
Self-Sovereign Identity (SSI) empowers users to manage their digital identities independently, but many systems are constrained to specific blockchains. Aries Cloud Agent Python (ACA-Py), based on Hyperledger Aries, supports decentralized identity but is limited to Hyperledger Indy, excluding Ethereum ecosystems. This paper proposes an adaptation layer that integrates ACA-Py with Ethereum by converting identity operations to Ethereum Virtual Machine (EVM)-compatible formats. The layer uses Python middleware (e.g., Registry.py, Wallet.py) and Solidity smart contracts (e.g., AnonCredRegistry, DIDManagement) for DID registration, schema publication, and credential management on-chain. Motivated by Ethereum's smart contract capabilities, this enhances SSI in EVM networks, enabling identity-based access controls and automated verifications. Unlike developing a new agent, this preserves ACA-Py's architecture, ensuring reusability and compliance with W3C DID/VC standards and Aries RFCs. Implemented with Python, Solidity, and Truffle Suite, the layer was tested on Ganache, validating credential issuance, verification, and DID anchoring. Evaluations showed low latencies (e.g., schema addition: 137 ms) and gas costs (e.g., DID registration: ~50,000 gas). A STRIDE-based security analysis confirms minimal vulnerabilities. This framework promotes interoperable SSI in EVM environments without core modifications.
With the exponential growth of digital systems, traditional centralized access control mechanisms such as RoleBased Access Control (RBAC) and Attribute-Based Access Control (ABAC) face significant challenges, including single points of failure, scalability limitations, and vulnerabilities to insider threats. These issues compromise the security, transparency, and auditability of access policies. This article explores the integration of blockchain technology with access control frameworks to mitigate these vulnerabilities. By leveraging decentralized ledgers and smart contracts, blockchain enhances transparency, tamperresistance, and traceability in policy enforcement and auditing processes. The study compares RBAC and ABAC implementations within blockchain environments, highlighting improvements in granularity, interoperability, and resilience. Through architecture models, smart contract code, and performance discussion, we demonstrate the potential of blockchain in enhancing access control security, transparency, and trustworthiness.