Metadata associated with IoT devices is stored. The metadata may include categories associated with the IoT devices. At least a first category may be hierarchical such that the first category includes at least two hierarchical levels, with each hierarchical level including at least two categories, and such that each category in a hierarchical level that is below another hierarchical level is a subset of one of the categories in the hierarchical levels above that hierarchical level. User information associated with users is stored. A request associated with one of the users and further associated with access to at least one of the IoT devices is received. Responsive to the request, the access is selectively granted to the at least one of the IoT devices based upon the stored user information and the stored metadata.