An apparatus and method to control access in a P2P (peer-to-peer) network. The apparatus for controlling access in a P2P network includes an attribute processing module to obtain an attribute of a service requestor and to determine an access control policy for the service requestor based on the obtained attribute; and an access control module to control the provision of a service to the service requester according to the access control policy. If a service provider is unable to obtain the attribute of the service requester, the service provider obtains the attribute of the service requester from at least one peer in the network.