The paper presents a graph-based access control model for cloud security which uses a formal graph structure to represent entities and their relationship. The proposed model describes cloud entities, including users, services, and data resources, as nodes in a graph (G) and access relationship among nodes are described using access relationships, including trust and cost attributes as edges. The measures of the performance of the proposed model include access decision time, computational complexity and the level of security. Experimental evidence and finding shows that the framework has lower access latency (around 12 ms) than RBAC (around 15 ms) and ABAC (around 22 ms), as well as a higher level of security effectiveness (around 92%) due to trust-aware validation and path-based control implementation. The model also has high scalability and dynamism in cloud environments. The graph-based framework proposed is an effective and efficient solution to next-generation cloud access control, and would be more effective than traditional methods both in terms of security and performance.