## 1 Introduction  
Continuous advancement in technology in general and the internet of things (IoT) in particular has increased the need for security and privacy. This fact imposes organizations and industry sectors to rethink how to control access to their logical and physical resourcesthrough modern and enhanced access control (AC) approaches [1; 2; 3]. AC is defined as the process of restricting access to resources based on a predefined set of rules known as AC policies. It consists of two main stages: authentication and authorization. Authentication is the process where an unknown subject (or user), after verifying his identity, becomes a known user. This process is insufficient to protect resources. Authorization is the process of allowing/denying authenticated users access to a resource after checking the regulations and policies of an organization or industry sector [4]. It includes the following phases [5; 6]:  
* defining a security policy (set of AC rules);
* selecting an AC model that matches the defined policy;
* implementing the model and enforcing the defined AC rules. In any organization or industry sector, one of the essential administrative responsibilities is to set policy rules to control access to objects accessed and administered in a domain. To mitigate security threats accompanied by information technologies, AC rules must consider possible threats in a domain. They should be concise and easy to understand so that everyone can follow the guidelines they set forth. AC rules outline the way a domain works with information and resources, and once they are created the domain's AC policy is customized [7; 8]. In today's digital environment, IoT and industry 4.0, users need effective protection for their resources distributed everywhere, and their ability to access information anytime, and from anywhere [9; 10; 11; 12]. Consequently, the evolution of AC policy languages should follow the development of computing environments and information systems (IS) [13; 14]. Developing an effective policy language is increasingly challenging due to the highly dynamic and heterogeneous structures of the current networking generation [5; 15; 16]. AC policy language should respond to the increasing demand for authorizing and controlling access to resources. It should express the organization's set of rules derived from business requirements, plans, guidelines, etc. There are several common AC models implemented in various centralized and distributed computing environments to control access to resources. These include discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC) [17; 18; 19]. As well, hybrid models, extended models, and abstracted models are implemented to enhance the features of common models as well as to enable the definition of a larger set of AC policies. A recent topic in this area is AC metamodels. They usually describe generic concepts and serve as unifying frameworks. AC models are instances of AC metamodels that are used to specify, define, and explain what, how, and when particular objects (resources) can be accessed by given individuals (subjects) [15; 18; 20]. Due to the ubiquitous nature of current computing environments, particularly industry 4.0, it is essential that advanced AC metamodels be developed to meet the increasing demand for AC requirements. In light of the limitations of the existing AC metamodels [6; 18], we propose a Hierarchical, Extensible, Advanced and Dynamic (HEAD) AC metamodel [15]. Compared to the other proposed works in this domain, e.g., [21; 22; 23], HEAD metamodel considers the challenging requirements which accompany the various technology progressions, for example, the need (1) to create hierarchical AC components that fit the diverse hierarchical organizational structures, (2) to define and upgrade a larger set of AC policies, (3) to have several AC solutions within the same organization (e.g., local network, IoT, and cloud), and many other challenges [20].