Open research questions in Access Control and Trust
78 gap statements mined from Access Control and Trust papers in our 4.5M-paper local library, which holds 410 papers on the topic — drawn mostly from each paper's own stated research gap, future-work, challenge and limitation notes, and its abstract. The ones listed below are a selection still marked open; each names the study that raised it, with a DOI link where the paper has one.
Choosing where to publish on Access Control and Trust? See the ranked Social Science journals.
What the literature leaves open
Future work should add machine-checked semantics, broader malicious-security backends, fault-injection campaigns under sustained WAN partitions, stronger utility analyses for DP releases, and public archival deposition of the full benchmark artifact with a persistent DOI. Those extensions would strengthen the framework further, but they are no longer prerequisites for interpreting the present claims correctly.
TrustDS: policy-compiled governance and verifiable evidence for cross-cloud marketplace analytics under explicit security assumptions · 2026 · DOINo study evaluates attacker persistence tactics or re-authentication bypass methods following passkey removal in WebAuthn/FIDO2 systems, or measures the time window during which compromised sessions remain valid after credential revocation. The temporal and behavioral aspects of post-revocation attack surface are not characterized.
None of these studies addresses user-driven deauthorization or session revocation in the context of passwordless authentication specifically, despite identifying user-driven deauthorization as an underdeveloped containment capability in MFA systems. The gap between MFA-centric revocation models and passwordless credential lifecycle management remains unexamined.
Emerging opportunities in automation, artificial intelligence, and adaptive security systems should be explored. The paper suggests that future research should focus on addressing the challenges and limitations of Zero Trust Architecture.
The traditional perimeter-based security models are increasingly ineffective. The assumption that internal networks are inherently secure no longer holds true. There is a need for a new security framework that can address modern cybersecurity threats.
Classical Public Key Infrastructure provides static identity guarantees but cannot guarantee that a given transaction originates from that entity at that moment. This gap enables replay attacks, key reuse vulnerabilities, and long-term compromise cascades.
The paper suggests that future research should focus on developing more effective and fair AI security taxonomies, based on harm-based classification and an extramural adversarial record. The paper suggests that future research should examine the implications of this approach on the security-law panel of the Meaning Feudalism series.
Adversarial by Origin: How the Classification of External Influence on Machine Meaning Becomes Law Without Becoming Jurisprudence (EA-SEI-ADVERSARY-01 v1.0) · 2026 · DOIThe paper argues that this gap must be addressed in order to develop more effective and fair AI security taxonomies.
Adversarial by Origin: How the Classification of External Influence on Machine Meaning Becomes Law Without Becoming Jurisprudence (EA-SEI-ADVERSARY-01 v1.0) · 2026 · DOIThe paper highlights the need for further research on the implications of export control directives on the development and deployment of AI models.
EA-SEI-ADVERSARY-01 Addendum: First Confirmation Marker, Deposit Day — Export Control Directive of 12 June 2026 · 2026 · DOIFuture research can focus on improving the standard and expanding its scope. Future research can explore the application of the standard in other domains.
The gap is the lack of a standardised architecture for Transparency Logs.
Future research can focus on addressing the challenges of consent withdrawal after model updates. Future research can explore the application of the proposed framework in different domains.
Adaptive Consent in Crisis AI: A Privacy-Ethics Framework for Continual Data Use in Resilient Communities · 2026 · DOIExisting approaches do not address the dynamic nature of consent in emergency settings. Prior work proposes privacy reduction methods in machine learning, but these approaches do not address the gap.
Adaptive Consent in Crisis AI: A Privacy-Ethics Framework for Continual Data Use in Resilient Communities · 2026 · DOIThe coverage gap analysis confirms that socket-only detection is insufficient and that DNS-layer monitoring must be the primary detection path in the current implementation.
VALKYRIE A Dual-Layer Architecture for Legitimate, Consumer-Scale Network Privacy Protection · 2026 · DOIThe paper treats these as a caveated spread rather than measurements, but a firmer empirical basis for the NHI population and its anchor distribution remains an open need (Section 12).
The study is limited to a single-case study approach. The study does not involve a large-scale survey or quantitative data collection. The study focuses on the OpenClaw framework and may not be generalizable to other autonomous agents.
Future research should focus on the development of more robust security mechanisms for autonomous agents. Future research should investigate the impact of autonomous agents on IT professional ethics. Future research should explore the need for more effective configuration and deployment strategies for autonomous agents.
Autonomous AI agents require deterministic governance. Traditional security measures are insufficient.
SAE-v1.0: Sovereign AI Execution Standard - Deterministic Governance for Autonomous AI. · 2026 · DOICurrent AI governance approaches are inadequate. OS-layer governance is not yet standardized.
The study suggests exploring the application of the proposed model in different domains and contexts.
DISEÑO DE UN MODELO DE CONTROL DE ACCESO BASADO EN ROLES Y SEGURIDAD A NIVEL DE FILAS EN APIS ACADÉMICAS · 2026 · DOIImprove behavioral analysis and anomaly detection using advanced and adaptive AI techniques. Multi-Platform Integration: Support seamless integration with cloud platforms and enterprise systems. Threat Intelligence: Use predictive analytics to detect and prevent emerging threats.
Existing methods fail to account for dangerous call arguments - MCP deployments rely on coarse consent prompts, leading to consent…
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization · 2026Developing effective access control mechanisms for institutional systems. Integrating security models into APIs. Addressing the gap in current access control systems.
DISEÑO DE UN MODELO DE CONTROL DE ACCESO BASADO EN ROLES Y SEGURIDAD A NIVEL DE FILAS EN APIS ACADÉMICAS · 2026 · DOIThe relevance-authorization gap, where retrieval systems rank documents by relevance rather than authorization. Tool-mediated disclosure, where agents invoke tools with agent credentials rather than end-user authorization. Context accumulation, where multi-turn conversations persist context without per-turn policy re-validation.
The following items represent the prioritized engineering and research roadmap: 9. Quantitative coverage evaluation: measure detection precision and recall against a labeled corpus (e.g., a subset of the Englehardt & Narayanan dataset) and benchmark against Pi-hole and NextDNS under identical conditions.
VALKYRIE A Dual-Layer Architecture for Legitimate, Consumer-Scale Network Privacy Protection · 2026 · DOI
Most-cited papers in Access Control and Trust
- Role-based access control models · Computer · 1996 · 4,164 citations
- Lattice-based access control models · Computer · 1993 · 476 citations
- Attribute-Based Access Control · Computer · 2015 · 467 citations
- Redefining Security · Foreign Affairs · 1989 · 394 citations
- Adding Attributes to Role-Based Access Control · Computer · 2010 · 289 citations
- A Survey on Zero Trust Architecture: Challenges and Future Trends · Wireless Communications and Mobile Computing · 2022 · 228 citations
- “Alexa, Can I Trust You?” · Computer · 2017 · 192 citations
- A blockchain based approach for the definition of auditable Access Control systems · Computers & Security · 2019 · 186 citations
- Security threats scenarios in trust and reputation models for distributed systems · Computers & Security · 2009 · 162 citations
- A national-scale authentication infrastructure · Computer · 2000 · 162 citations
Most recent work
- Adversarial by Origin: How the Classification of External Influence on Machine Meaning Becomes Law Without Becoming Jurisprudence (EA-SEI-ADVERSARY-01 v1.0) · Zenodo (CERN European Organization for Nuclear Research) · 2026
- zk-Guard: A Privacy-Preserving Access Control Framework Based on zk-SNARKs and Blockchain for Decentralized Data Sharing · IEEE Transactions on Dependable and Secure Computing · 2026
- Operationalizing the EU AI Act through eIDAS Trust Services Primitives: A Reference Mapping for High-Risk AI Systems · Open MIND · 2026
- EA-SEI-ADVERSARY-01 Addendum: First Confirmation Marker, Deposit Day — Export Control Directive of 12 June 2026 · Zenodo (CERN European Organization for Nuclear Research) · 2026
- The Authorization Artifact Gap in AI Governance, Regulatory, and Audit Frameworks: Formal Notice of a Known Structural Limitation in Observability-Based AI Oversight · Zenodo (CERN European Organization for Nuclear Research) · 2026
- Chain Integrity in Autonomous Governance Systems · Zenodo (CERN European Organization for Nuclear Research) · 2026
- Transparency Log Standard: AI Refusal Logic and GPAI Systemic Risk Compliance · Zenodo (CERN European Organization for Nuclear Research) · 2026
- LATTICE: a governance-first architecture for authorized autonomous AI operations · Frontiers in Artificial Intelligence · 2026
- Zero-Knowledge Proof Framework for Identity Verification and Interoperable Payments on the Decentralized Web · ACM Transactions on the Web · 2026
- An explainable method for security requirements classification through transformer models · Future Generation Computer Systems · 2026
Find a gap in your own Access Control and Trust sub-topic
This page shows what the Access Control and Trust literature already flags as unresolved. To narrow it to your specific question, search the Research Gap Finder: the search is free with a free account and lists the papers closest to your topic first. Unlocking that topic (50 credits, charged once) fills the comparison table from our 4.5M-paper local library and writes the gaps from its rows.
Open the Research Gap Finder →