core/modules/jsonapi/src/JsonApiResource/Link.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/core/modules/jsonapi/src/JsonApiResource/Link.php b/core/modules/jsonapi/src/JsonApiResource/Link.php
index f098572a65..5f7838adeb 100644
--- a/core/modules/jsonapi/src/JsonApiResource/Link.php
+++ b/core/modules/jsonapi/src/JsonApiResource/Link.php
@@ -4,6 +4,7 @@
 
 use Drupal\Component\Assertion\Inspector;
 use Drupal\Component\Utility\DiffArray;
+use Drupal\Core\Access\AccessResultInterface;
 use Drupal\Core\Cache\CacheableDependencyInterface;
 use Drupal\Core\Cache\CacheableDependencyTrait;
 use Drupal\Core\Cache\CacheableMetadata;
@@ -72,10 +73,13 @@ final class Link implements CacheableDependencyInterface {
    *   An array of registered or extension RFC8288 link relation types.
    * @param array $target_attributes
    *   An associative array of target attributes for the link.
+   * @param \Drupal\Core\Access\AccessResultInterface|null $access
+   *   (optional) An access result indicating whether the link can be accessed
+   *   by the current user.
    *
    * @see https://tools.ietf.org/html/rfc8288#section-2.1
    */
-  public function __construct(CacheableMetadata $cacheability, Url $url, $link_relation_type, array $target_attributes = []) {
+  public function __construct(CacheableMetadata $cacheability, Url $url, $link_relation_type, array $target_attributes = [], AccessResultInterface $access = NULL) {
     // @todo Remove this conditional block in drupal:9.0.0 and add a type hint to the $link_relation_type argument of this method in https://www.drupal.org/project/drupal/issues/3080467.
     if (is_array($link_relation_type)) {
       @trigger_error('Constructing a ' . self::class . ' with an array of link relation types is deprecated in drupal:8.8.0 and will throw a fatal error in drupal:9.0.0. Pass a single string instead. See https://www.drupal.org/node/3087821.', E_USER_DEPRECATED);
@@ -95,6 +99,12 @@ public function __construct(CacheableMetadata $cacheability, Url $url, $link_rel
     $this->rel = $link_relation_type;
     $this->attributes = $target_attributes;
     $this->setCacheability($cacheability->addCacheableDependency($generated_url));
+    if ($access !== NULL) {
+      if (!$access->isAllowed()) {
+        throw new \LogicException('Only accessible links may be added to JSON:API documents.');
+      }
+      $this->setCacheability(CacheableMetadata::createFromObject($this)->addCacheableDependency($generated_url));
+    }
   }
 
   /**