Managing access control within system topologies by using canonical access control representations is disclosed. A set of accessor-accessible pairs is determined. Each accessor has a predetermined level of access to its paired accessible within a system topology. For each unique accessible within the set of pairs, the accessors that are paired with it are sorted and merged as a first proto-zone. For each unique subset of accessor(s) within the set of first proto-zones, the accessibles that are associated with it are sorted and merged as a second proto-zone. The second proto-zones are sorted to yield a canonical set of zones. Each zone has accessor(s) and accessible(s). The canonical set of zones is used to manage the access control of the accessors and the accessibles within the topology.