diff --git a/eck.api.php b/eck.api.php
index e8d96e9..52fe239 100644
--- a/eck.api.php
+++ b/eck.api.php
@@ -144,3 +144,39 @@ function hook_eck_entity_save_message_alter(&$msg, $args, $context) {
 function hook_eck_bundle_save_message_alter(&$msg, $args, $context) {
   $msg = 'set this variable to change save message.';
 }
+
+/**
+ * Control access to ECK entities.
+ *
+ * Modules may implement this hook if they want to have a say in whether or not
+ * a given user has access to perform a given operation with ECK entities.
+ *
+ * @param string $op
+ *   The operation being performed. One of 'view', 'update', 'create' or
+ *   'delete'.
+ * @param mixed $entity_or_bundle
+ *   Normally, an entity to check access for. If this is NULL, we are checking
+ *   access for all entities of the given type. If this is a string
+ *   (representing the bundle to check access for; see parallel example in
+ *   node_access()) we are checking access for all entities of the given type
+ *   and bundle.
+ * @param object $account
+ *   The user to check access for. If this is NULL, access will be checked for
+ *   the current user.
+ * @param string $entity_type_name
+ *   A string representing the type of entity to check access for.
+ *
+ * @return bool
+ *   TRUE if access is granted, FALSE otherwise.
+ */
+function hook_eck_entity_access($op, $entity_or_bundle, $account, $entity_type_name) {
+  // Only check access for an entity.
+  if (is_object($entity_or_bundle)) {
+    $entity = $entity_or_bundle;
+    // Deny edit access if the current user is not the author of the entity.
+    if ($op == 'edit' && isset($entity->author) && $entity->author != $account->uid) {
+      return FALSE;
+    }
+  }
+  // Do not alter otherwise.
+}
diff --git a/eck.module b/eck.module
index a0e0da8..e7d7661 100644
--- a/eck.module
+++ b/eck.module
@@ -856,6 +856,17 @@ function eck__entity_access($op, $entity_or_bundle, $account, $entity_type_name)
 
   // @todo should auto-load entity author here.
 
+  // Allow modules to grant or deny access.
+  $access = module_invoke_all('eck_entity_access', $op, $entity_or_bundle, $account, $entity_type_name);
+  // Only grant access if at least one module granted access and no one denied
+  // access.
+  if (in_array(FALSE, $access, TRUE)) {
+    return FALSE;
+  }
+  elseif (in_array(TRUE, $access, TRUE)) {
+    return TRUE;
+  }
+  // If no hooks granted or restricted access, fall back to default check.
   return eck__multiple_access_check($permissions, FALSE, $account);
 }