NIST - Access Control Recommendations

Subjects	Operations	Objects
IaaS end user	Login, Read, Write, Create	Hypervisor
IaaS end user	Read, Write, Create	VMs
VM	Write	Hypervisor
VM	Read, Write	Other VMs within the same host
VM	Read, Write, Create	Guest OS images
VM	Read, Write	Other VMs from different hosts but within the same IaaS provider
VM	Read, Write	Other VMs from different IaaS providers
Hypervisor	Read, Write, Create	Guest OS images
Hypervisor	Read, Write	Hardware resources
Hypervisor	Read, Write, Create	VMs

Subjects	Operations	Objects
Application user	Read	Memory data
VM of a hosted application	Read, Write	Other applications' data within the same host
Application developer	Create, Read, Write	Middleware data, memory data
Cloud service provider	Replicate	Application-related data

Subjects	Operations	Objects
Application user	Read, Write	Application-related data
Application user	Read	Memory
Application user	Execute	Application
Application user	Read, Write	Application data
Application user	Execute	Application code
VM of a hosted application	Execute	Other application code within the same host