The present invention generally is directed to a method, system and article of manufacture for controlling the access to data granted to a requesting entity based upon data accessed by the entity in the past. Additionally, embodiments of the present invention allow for access control independent from the particular manner in which the data is physically represented. Generally, abstraction layers are provided to represent various data sources available for use by an application and to compose queries used by the application to access and/or update information contained in these data sources. A runtime component is responsible for resolving an abstract query into concrete data access requests to one or more data repositories using information contained in a data repository abstraction component (one of the abstraction layers). Typically, data is organized into a series of domains. Within each domain, data is associated with an account. User activity is monitored, and when data associated with one account is accessed, a user may subsequently be prohibited from accessing data from a related account within the same domain.