Abstract: An organization-based access control (OBAC) system defines resource access rights using graph-based team node trees, each comprising a plurality of hierarchically-connected team nodes. Each team node is associated with a list of members, team resources, and a team-specific access policy that defines the rights of team members to access the team resources. When a node in a tree has one or more descendant nodes, boundary access policies can be generated to define rights, of members of the node, to access resources associated with descendant nodes. Such boundary access policies may grant parent team members different access rights for child team resources than is granted to the child team members. A node management policy can grant rights to manage a portion of a team node tree. Team-specific access policies, boundary access policies, and management policies can include unique references to one or more particular resources, resource attributes, or groups of resources.