Token gating uses ownership of an on-chain asset as an entry condition for a website, community or event. The mechanism is simple, and its limitations follow directly from that simplicity.
The check is a signature plus a balance query
A user proves control of an address by signing a message, which costs nothing and involves no transaction.
The application then queries the chain for that address's balance of a specified token or collection and grants or refuses access accordingly.
Nothing is written anywhere. The whole exchange is a read against public data combined with a proof that the visitor holds the corresponding key.
Enforcement sits with the application
The chain confirms ownership; it does not enforce anything about what happens next. The gate is code running on a conventional server.
If that server is misconfigured or its session handling is weak, access can be obtained without ever satisfying the token requirement.
The guarantee is therefore about who holds the asset, not about how carefully the door is guarded.
Ownership is transferable and rentable
Because access follows the token, selling it transfers the access, which is a feature for membership resale and a problem for anything meant to be personal.
Assets can also be borrowed for the duration of a check, and delegation arrangements let a holder grant verification rights to another address without moving the asset.
A gate that grants a benefit worth more than the cost of temporarily obtaining the token will be satisfied that way.
Snapshots and live checks behave differently
A live check reads the balance at the moment of access, so selling the asset ends the access immediately.
A snapshot records holders at a chosen block, which prevents last-minute acquisition but also lets someone sell afterwards while retaining the benefit.
Which approach suits a situation depends on whether the benefit is ongoing or a single distribution.
What it is genuinely good at
Gating removes the need to maintain a membership database, since the list of eligible holders is public and updates itself as tokens change hands.
It also works across applications without coordination, because any service can read the same ownership record without an agreement with anyone.
Where it fails is as a substitute for identity, since a wallet establishes possession of a key and nothing at all about the person holding it.