GBAC has been a thing for a long time but not really picked up: https://en.wikipedia.org/wiki/Graph-based_access_control