1. A method for execution by one or more processing modules of one or more computing devices of a dispersed storage network (DSN), the method comprises: receiving a data access request for at least one data segment stored in the DSN; identifying a vault associated with the data access request and one of a plurality of sub-vaults associated with the vault; retrieving access information corresponding to the one of the plurality of sub-vaults to determine whether the data access request is allowed; when the data access request is allowed, retrieving a sub-vault directory associated with the one of the plurality of sub-vaults to identify a DSN address corresponding to the data access request, and fulfilling the data access request based on the DSN address.