The 31st ACM Symposium on Access Control Models and Technologies (SACMAT)
July 8 - 10, 2026. Waterloo, Canada


Call for Papers

Access control has long been one of the most widely adopted and
foundational security technologies. It has been seamlessly integrated
into operating systems like Multics and Unix—pioneering platforms that
contributed to Turing Award-winning innovations—and continues to
underpin security in modern mobile devices and cloud computing. Its
efficiency and effectiveness have stood the test of time. However, the
landscape of computing has dramatically changed since the inception of
the ACM Symposium on Access Control Models and Technologies (SACMAT)
conference in 1994. We now operate in a deeply interconnected,
networked world where no single application or device can act as a
fully trusted reference monitor to enforce access control in
isolation. This shift demands new trust models, management strategies,
enforcement techniques, and supporting mechanisms, such as advanced
authentication. In response, SACMAT invites researchers to explore and
propose innovative, efficient, and effective security mechanisms
designed for distributed, networked computing environments.

Topics of Interest

The 31st ACM Symposium on Access Control Models and Technologies
(SACMAT) invites submissions presenting novel contributions in
efficient and effective security mechanisms for distributed, networked
computing environments. Topics of interest include, but are not
limited to:

Authorization Models and Policies
Mechanisms
Data
Systems
Usability and Measurement
Authorization Models and Policies

    Analysis of Policy and Policy Models
    Policy Enforcement
    Policy Model and Language Design
    Policy Maintenance, Migration, and Mining
    Policy Verification

Mechanisms

    AI/ML Techniques
    Authentication
    Cryptographic Techniques
    Economic Models and Game Theory
    Hardware Security Techniques (e.g., Intel SGX)
    Programming Language-based Techniques
    Zero Trust Architecture

Data

    Big Data
    Confidential Computing
    Data Leakage Prevention
    Data Privacy
    Data Protection
    Usage Control

Systems

    Cloud, Edge, and Fog Computing
    Cyber Physical Systems
    Design for Resiliency
    Distributed Systems
    Embedded Systems
    IoT Systems (e.g., Home Automation, Autonomous Vehicles)
    ML-driven, Autonomous Systems (e.g., AI chatbots)
    Networks (including Wireless and Satellite)
    Operating Systems
    Physical Access Control
    Web Systems

Usability and Measurement

    Usable Access Control Systems
    User Studies for Access Control
    Measurement Studies of Access Control Usefulness, Failures,
      Effectiveness, or Impact

Paper Tracks

Authors are invited to submit full research papers (10 pages,
excluding 2 pages for bibliography/appendices) for the Main Research
Track. In addition to the Main Research Track, we invite authors to
consider the following special tracks.

BlueSky (up to 8 pages): Papers that present visionary ideas,
long-term challenges, and research opportunities that are outside of
the current mainstream topics in the field.

Dataset/Tool (up to 5 pages): Papers that present a novel curated
dataset, a novel synthetic dataset generation process, or the design
and implementation of a novel tool incorporating previously proposed
research and technologies. The papers must clearly discuss the
audience benefiting from them (e.g., researchers/practitioners) and
evaluate their contributions using experiments or case studies.
Systematization of Knowledge (up to 12 pages): Papers that evaluate,
systematize, and contextualize existing knowledge in a relevant area
to our community. While papers that present a convincing,
comprehensive new taxonomy of such an area are welcomed, survey papers
without such insights are not appropriate and may be rejected without
full review.  Work in Progress (up to 6 pages including references):
Papers that present early-stage research problems and results that
might not be fully developed. This track is ideal for early-stage
graduate students to obtain early, constructive feedback on their
work.

All papers must be thoroughly anonymized for double-blind
review. Information that might identify the authors, including author
names, affiliations, acknowledgements, or obvious self-citations, must
be excluded. It is the authors' responsibility to ensure that their
anonymity is preserved when citing their own work. Posting a preprint
of the paper to an archival repository such as arXiv is
acceptable. However, authors should refrain from widely advertising
their results and may not directly contact PC members to discuss their
submission.

All submissions must contain a significant original contribution. They
must not substantially overlap papers that have been published or that
are simultaneously submitted to a journal, conference, or
workshop. Wherever appropriate, relevant related work, including that
of the authors, must be cited.

Submissions that are not accepted as full papers may be invited to
appear as Work in Progress papers. At least one author from each
accepted paper must register (with a full registration) for the
conference before the camera-ready deadline and is expected to present
it in person at the conference (remote presentations are possible only
in exceptional cases, e.g., a last-minute positive COVID case).

Decisions (And new this year, Major Revisions in Cycle 1)

Unlike previous year, SACMAT 2026 will have two review
cycles. Submissions to any of the two review cycles will receive one
of the following decisions:

    Accept: Papers in this category will be accepted for publication
    in the proceedings and presentation at the conference.

    Conditional Accept (with shepherding): Papers in this category
    will be accepted for publication in the proceedings and
    presentation at the conference if they successfully undergo
    shepherding, and the changes are determined satisfactory by their
    shepherd(s).

    Reject: Papers in this category submitted in the 1st cycle will be
    rejected without review if resubmitted to the 2nd cycle.

New in SACMAT 2026 - Major Revision for Cycle 1 submissions to the
Main Research Track: In addition to the above, SACMAT 2026 will also
consider a small number of papers submitted in Cycle 1 to the Main
Research Track for major revisions. This decision will be reserved for
a few papers that are considered promising by the reviewers, but need
additional work (e.g., implementation, experiments, and/or extensive
rewriting) to be ready for publication at SACMAT. This decision will
be accompanied by a set of revision criteria from the PC.

Authors receiving the "Invited for Major Revision" decision in Cycle 1
may choose to resubmit such revised papers to Cycle 2, and the revised
papers will be reassessed by the same set of reviewers, using the
pre-defined revision criteria. A revised paper will receive either an
"Accept", "Conditional Accept", or "Reject" decision, i.e., the
reviewers may choose to reject a paper if the revision does not meet
the criteria.  Submission Guidelines

All submissions must be in PDF format using ACM’s double-column
"sigconf" template(see
https://www.acm.org/publications/authors/submissions). Papers
submitted to the Main Research Track must be no more than 10 pages
long, excluding up to 2 pages of bibliography and well-marked
appendices. Note that reviewers are not required to read the
appendices.

Submissions to the other tracks must include the subtitle "[TrackName
Paper]" in the PDF file (e.g., using \subtitle{[BlueSky Paper]} in
LaTeX). In addition to the page limits stated for each track, the
papers may include a bibliography and appendices of no more than 2
pages for BlueSky and Systematization of Knowledge papers, and 1 page
for other tracks.

HotCRP Submission Link for Cycle 1: https://sacmat26-cycle1.hotcrp.com/

HotCRP Submission Link for Cycle 2: https://sacmat26-cycle2.hotcrp.com/
Important Dates
First Cycle Deadlines
Paper Submission 	October 27, 2025 October 31, 2025 (Extended)
Author Notification 	December 14, 2025 December 19, 2025 (Extended)
Second Cycle Deadlines
Paper Submission 	March 2, 2026 March 6, 2026 (Extended)
Author Notification 	April 6, 2026 April 10, 2026 (Extended)
Camera-Ready 	May 7, 2026 May 10, 2026 (For both Cycles)
Artifact Evaluation Deadlines
Artifact Submission Deadline 	April 13, 2026 April 18, 2026
Artifact Evaluation Reviewer Questions Period April 16 - 30, 2026
   April 20 - May 2, 2026
Artifact Evaluation Decision 	May 3, 2026 May 4, 2026
Final Papers with Badge Labels Due 	May 10, 2026 (For both Cycles)
For more details, read the Call for Artifacts
Conference Dates
Conference Dates 	July 8 - 10, 2026
All deadline times are 11:59 PM AoE (UTC-12).
ACM Publication Policies

By submitting your article to an ACM Publication, you are hereby
acknowledging that you and your co-authors are subject to all ACM
Publications Policies, including ACM's new Publications Policy on
Research Involving Human Participants and Subjects. Alleged violations
of this policy or any ACM Publications Policy will be investigated by
ACM and may result in a full retraction of your paper, in addition to
other potential penalties, as per ACM Publications Policy.

Please ensure that you and your co-authors obtain an ORCID ID, so you
can complete the publishing process for your accepted paper. ACM has
been involved in ORCID from the start and we have recently made a
commitment to collect ORCID IDs from all of our published authors. We
are committed to improve author discoverability, ensure proper
attribution and contribute to ongoing community efforts around name
normalization; your ORCID ID will help in these efforts.

Important update on ACMs new open access publishing model for 2026 ACM Conferences!

Starting January 1, 2026, ACM will fully transition to Open
Access. All ACM publications, including those from ACM-sponsored
conferences, will be 100% Open Access. Authors will have two primary
options for publishing Open Access articles with ACM: the ACM Open
institutional model or by paying Article Processing Charges
(APCs). With over 2,600 institutions already part of ACM Open, the
majority of ACM-sponsored conference papers will not require APCs from
authors or conferences (currently, around 76%).

Authors from institutions not participating in ACM Open will need to
pay an APC to publish their papers, unless they qualify for a
financial waiver. To find out whether an APC applies to your article,
please consult the list of participating institutions in ACM Open and
review the
https://www.acm.org/publications/policies/policy-on-discretionary-open-access-apc-waivers. Keep
in mind that waivers are rare and are granted based on specific
criteria set by ACM.

Understanding that this change could present financial challenges, ACM
has approved a temporary subsidy for 2026 to ease the transition and
allow more time for institutions to join ACM Open. The subsidy will
offer:

    $250 APC for ACM/SIG members
    $350 for non-members

This represents a 65% discount, funded directly by ACM. Authors are
encouraged to help advocate for their institutions to join ACM Open
during this transition period.

This temporary subsidized pricing will apply to all conferences
scheduled for 2026.