Changing access permission based on usage of computer resources including maintaining records of a user's usage of computer resources in a security domain, the user having a scope of access permission for the computer resources; measuring the user's disuse of one or more of the computer resources in the security domain; and degrading the user's scope of access permission for the computer resources in dependence upon the user's disuse. Typical embodiments include receiving from a user a request for access to a requested computer resource, receiving from the user a request to upgrade the user's degraded scope of access permissions to grant access to the requested computer resource and upgrading, in dependence upon the user's request to upgrade the degraded scope of access permissions, the user's degraded scope of access permissions to grant access to the requested computer resource.