Access control request parameter interleaving may be implemented that supports user-configurable and host-configurable processing stages. A request may be received and evaluated to determine whether user-configured interleaving, host-configured interleaving, or both user-interleaving and host-interleaving are applied. For applied interleaving, two different portions of a request parameter may be swapped.