Dynamic control of access to managed content is disclosed. In some embodiments, an ACL includes a “dynamic” group having an associated list of potential members. In any given session and/or at any point in time, whether a user is considered a currently valid member of the group, and therefore allowed access to managed content in accordance with an access right or privilege granted to the group with respect to one or more content items is determined, e.g., based on application context (what operation the user is trying to perform, etc.) and/or other context information (time of date, location of system from which access was requested, etc.).