We show how access to Web resources may be controlled by using an access control program that implements a reactive agent. The agent reasons about the events, actions and a history (of events and actions) that relate to a user in order to make decisions about permitting the user to access information that is held on remote servers. The access control program is based on an abstract access control model that is formally specified as a clause form theory. Access policies may be efficiently implemented in a variety of practical languages.