1. A method for execution in a dispersed storage network (DSN), the method comprises: receiving, by a first computing device of the DSN, a data access request relating to at least one set of encoded data slices stored in the DSN, the data access request including requesting entity credentials and a data request having an associated request type, wherein at least a threshold number of encoded data slices of the set of encoded data slices is required to recover a corresponding data segment; selecting, by the first computing device, one of a plurality of identity units based on the requesting entity credentials; determining, via the selected one of the plurality of identity units, whether to allow the data access request; when the selected one of the plurality of identity units indicates that the data access request is allowed based on the requesting entity credentials, selecting, by the first computing device or a first storage unit of a set of storage units, another one of the plurality of identity units based on the data request; determining, via the selected other one of the plurality of identity units, whether to allow the associated request type of the data request based on access control information for at least a portion of a vault identified by a vault identifier associated with the requesting entity credentials, wherein the at least a portion of the vault comprises a sub-vault associated with the requesting entity credentials: and when the associated request type of the data request is allowed by the selected other one of the plurality of identity units, performing, by the first storage unit, a first corresponding portion of the data access request.