Abstract: Some embodiments manage storage of access data to provide flexible and granular control over storage costs without risking policy compliance, regulatory compliance, or data breach investigation. Resources are classified and given metadata labels. Resource access data is associated with the accessed resource metadata label. A mapping is defined between metadata groups and access data storage boxes. Access data storage box definitions may specify metadata labels. A mapping structure also defines a policy governing use of available storage capacity in access data storage boxes. Per the policy and the available capacity, particular access data may be stored in a particular box, be spilled over to a different box, or be denied storage. Accordingly, the costs of storing access data can be capped and made predictable, and storage of specific kinds of access data can be favored.