AM & Access

Next-Generation Access Control (NGAC)

A NIST standard where users, resources, and everything else are nodes in one graph, and access is computed by traversing it — general enough to express RBAC, ABAC, and DAC-style policies within a single model.

aka: NGAC

NGAC’s pitch is unification: instead of choosing RBAC or ABAC or ReBAC and living with that model’s blind spots, everything — users, objects, attributes, policy classes — is a node in one graph, and a decision is a reachability question over it. It’s powerful and expressive, but that same generality makes it harder to reason about and less widely adopted than the simpler models it can subsume.