A computer implemented method for access control for a restricted resource in a computer system, the method comprising: receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the resource is accessed in an approved manner; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory, HTM,; training the HTM based on the training set in order that the trained HTM provides a model of the operation of the computer system during the training time period; receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the resource, the consumer having allocated a quantity of cryptocurrency; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system by the consumer as unauthorised, wherein, responsive to the identification that the operation by the consumer is unauthorised, depleting an amount of the cryptocurrency allocated to the consumer; and precluding access to the computer system and/or resource in response to expenditure of the cryptocurrency allocated to the consumer, wherein the method operates continuously. receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the resource is accessed in an approved manner; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory, HTM,; training the HTM based on the training set in order that the trained HTM provides a model of the operation of the computer system during the training time period; receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the resource, the consumer having allocated a quantity of cryptocurrency; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system by the consumer as unauthorised, wherein, responsive to the identification that the operation by the consumer is unauthorised, depleting an amount of the cryptocurrency allocated to the consumer; and precluding access to the computer system and/or resource in response to expenditure of the cryptocurrency allocated to the consumer, wherein the method operates continuously.