Software-Defined Networking (SDN) allows applications to control and manage the network from the northbound interface. These network applications can be installed by a third party; that cannot be trusted blindly. A Misconfigured or compromised application is a severe threat to the SDN controller. Providing proper access control mechanism to SDN applications can prevent malicious activities. However, the existing access control mechanisms define the static access permissions, and cannot prevent the malicious activities of the application at runtime. Therefore, we propose "BEAM", a BEhavior-based Access control Mechanism which dynamically grants the permissions based on the analysis of network behavior. BEAM periodically upgrades/downgrades the assigned access permissions, verifies and builds trust for an application. © 2019 IEEE.