Abstract: In implementations of a repeatable NGAC policy class structure, a computing device implements a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes modeled with a composable policy class structure that is repeatable to instantiate each of the multiple policy classes in the graph. The composable policy class structure includes a policy class as enforceable access criteria by which the user elements are allowed or denied access to the object elements that represent the resources, an exclusion default object node and an exclusion default user node of the policy class, and an association that indicates object elements contained as members of the exclusion default object node granting all policy permissions to user elements contained as members of the exclusion default user node. The NGAC graph can be utilized to compute an access control decision across the multiple policy classes.