  In the spirit of device-independent cryptography, we present a two-party
quantum authorization primitive with non-locality as its fueling resource.
Therein, users are attributed authorization levels granting them access to a
private database accordingly. The authorization levels are encoded in the
non-local resources distributed to the users, and subsequently confirmed by
their ability to win CHSH games using such resources. We formalize the
protocol, prove its security, and frame it in the device-independent setting
employing the notion of CHSH self-testing via simulation. Finally, we provide a
proof-of-concept implementation using the Qiskit open-source framework.
