## 1 Introduction
The domain-specific language (DSL) [24] of the HEAD metamodel--which is defined using Eclipse (xtext) [25; 26]--is generic enough to include the heterogeneity of AC models, this allows defining larger sets of AC policies. It supports the hierarchy of all components to conform to organizational hierarchy. The derived models of the HEAD metamodel can be extended to follow policy updates. Also, it is dynamic since various components/attributes can be added to follow technology progressions and include several AC solutions in an organization. In this paper, for the validation of the HEAD metamodel, we propose two case studies that include different conditions (e.g., static and dynamic AC policies, different contexts, etc. ), and technical aspects (e.g., local and distributed devices, sensors, etc.) to show how our proposed metamodel can provide the necessary AC requirements and how it can be adapted to different computing environments. The existing case studies are extremely limited and barely contain the necessary elements we need to demonstrate our solution. In two case studies, we demonstrate our solution in the computing environment of Institut technologique de maintenance Industrielle (ITMI) of Sept-Iles, Quebec. The first case study deals with ITMI's local computing environment (in this paper, we refer to it as a non-IoT environment), while the second case study deals with their IoT environment. The first case study deals with ITMI's local computing environment (in this paper, we refer to it as a non-IoT environment), while the second case study deals with their IoT environment. Hence, we use the DSL of HEAD metamodel presented and explained in [15] to derive the AC models required for each case study. The derived models of each case are encoded using Eclipse Xtend notation (an expressive dialect of Java) to represent the concrete instance of AC policies and generate the needed Java code to express the AC rules as Cypher queries. As an enforcement point and to verify the accuracy and the coherence of the concrete instances of AC policies, Cypher queries are injected into the Neo4 database to represent the generated rules in the form of Next Generation Access Control (NGAC) which is developed by National Institute of Standards and Technology (NIST) [27; 28] policy graph--the objects, the relationships between them, and the subjects that interact with the system in a form that adheres to the semantics of ITMI. NGAC policy graph is constructed with the basic policy elements and a fixed set of relationships [27; 29]. The NGAC policy elements represented in the NGAC policy graph are illustrated in Figure 1:  
* the authenticated users (U), and their user attributes (UA). * the objects (O) that need to be accessed, and their attributes (OA). * the policy class(es) (PC). * the assignment relationships between U-UA, UA-UA, O-OA, OA-OA, UA-OA, and UA-OA to the appropriate PC(s). * the association relationships to define the access rights associated with some UAs to perform operations on some objects specified by OAs. Both case studies show that the HEAD AC metamodel can be adapted to meet AC requirements in non-IoT and IoT environments. However, compared to already published works in this domain, this paper's contribution can be summarized as follows:  
* Presents two industrial case studies illustrating the implementation of a new and advanced metamodel (named HEAD metamodel) from the definition of AC rules to the enforcement of policies. None of the existing works in this domain present a real case study or address all the needed phases to enforce the defined AC rules. * Provides modern AC tools and shows how they can be adapted to different computing environments, especially industrial environments. Others in this field have only provided some explanations for manually illustrating some simple examples. They lack a detailed illustration of the tools available and how to enforce AC rules.