A method, implemented at a computer system that includes a processor, for confining lateral traversal within a computer network, the method comprising: receiving an authorization request (301, 306) that includes (a) an authentication token (302, 307) that identifies a credential and a first protected resource (103n, 105a) within the computer network, and (b) an identifier of a second protected resource within the computer network for which authorization is requested; determining, based on a capability of the credential, whether or not the credential is configured for access to the second protected resource; identifying a lateral traversal policy associated with the second protected resource, the lateral traversal policy constraining access to the second protected resource to only resources within the computer network that belong to a particular subset of resources to which the second protected resource belongs; determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs; and based at least on determining that the credential is configured for access to the second protected resource, performing one of: when the first protected resource is determined to belong to the particular subset of resources to which the second protected resource belongs, issuing an authorization token that authorizes the credential to access the second protected resource via the first protected resource; or when the first protected resource is determined to be outside the particular subset of resources to which the second protected resource belongs, denying the authorization request. receiving an authorization request (301, 306) that includes (a) an authentication token (302, 307) that identifies a credential and a first protected resource (103n, 105a) within the computer network, and (b) an identifier of a second protected resource within the computer network for which authorization is requested; determining, based on a capability of the credential, whether or not the credential is configured for access to the second protected resource; identifying a lateral traversal policy associated with the second protected resource, the lateral traversal policy constraining access to the second protected resource to only resources within the computer network that belong to a particular subset of resources to which the second protected resource belongs; determining whether or not the first protected resource belongs to the particular subset of resources to which the second protected resource belongs; and based at least on determining that the credential is configured for access to the second protected resource, performing one of: when the first protected resource is determined to belong to the particular subset of resources to which the second protected resource belongs, issuing an authorization token that authorizes the credential to access the second protected resource via the first protected resource; or when the first protected resource is determined to be outside the particular subset of resources to which the second protected resource belongs, denying the authorization request. when the first protected resource is determined to belong to the particular subset of resources to which the second protected resource belongs, issuing an authorization token that authorizes the credential to access the second protected resource via the first protected resource; or when the first protected resource is determined to be outside the particular subset of resources to which the second protected resource belongs, denying the authorization request.