authorization to interact with an agent

I'm going to throw this out here to see if anyone can assist in my thought
process...

Somewhere there is a device/agent identified by a key:did. Somewhere there
is a list with agents A, B, C, D that have access to this device agent
identified by this key:did. Agent E should not have access to the
device/agent identified by the key:did. Agent B
should.

This comes to mind as an analogue, but it may not be perfect:
http://solid.github.io/web-access-control-spec/ .

It may be tomorrow with a fresh mind that this makes sense. Just look at
verifiable presentation / verifiable credentials again?

https://www.w3.org/TR/vc-data-model/#authorization  ?

-Brent