A method of controlling access to a target resource of a plurality of resources managed by a control plane executing on a computing system includes: receiving, at the control plane, a request for the target resource by a client, the request including a user indicator; identifying a user group in which the user indicator is a member; identifying a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the group of resources defined by a query executable against an index of states of the plurality of resources; obtaining a state of the target resource in response to the request; and applying the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.