1. A method, comprising: a storage device negotiating a plurality of revocable token identifiers with an access server, wherein the access server, in response to receiving from a client an access request for one or more blocks in a specific storage volume, issues to the client an access token comprising: one of the revocable token identifiers for the requested one or more blocks, and a token for the specific volume, such that the access token is a layered token granting access permission to the specific volume and to one or more specific blocks or one or more ranges of blocks of data within the specific volume; and the storage device, in response to receiving from the client a storage request including the issued access token, granting the storage request if the access token includes the token for the specific volume and one of the revocable token identifiers.