To provide an access management system and an access management method for flexibly combining various access restrictions for each function.

The access management system includes: an access request acquisition part 11 for acquiring an access request to an information resource requested by a user; a determination program storage part 14 for storing a plurality of determination programs corresponding to each of a plurality of determination references for determining the presence/absence of access authority; a user information definition table 123 for defining user information as the object of comparison with the determination references; an execution sequence definition table 121 for defining a determination program to be executed in response to the access request and an execution sequence; and an access authority determination part 13 for acquiring the user information from the user information definition table 123 and the determination program to be executed and the execution sequence from the execution sequence definition table 121 based on the access request, and for successively executing the determination program, and for determining the presence/absence of the access authority of the user according to the combination of the logical sum and the logical product of the respective determination results.