Access management techniques have been developed to specify and facilitate mappings between I/O and host domains in ways that are storage-efficient and which can provide flexibility in the form, granularity and/or extent of mappings, attributes and access controls coded relative to a particular I/O domain. Indeed, different identifier and/or operation translation models may be employed on a per logical device (or even a per sub-window) basis. In general, the flexibility and efficiency afforded using some embodiments of the present invention can be desirable, particularly as numbers of I/O domains increase, such as in the case of virtualization system implementations in which a multiplicity of logical I/O devices may be represented using underlying physical resources.