<p>Interface authorization in flexible automated mine ventilation duct production lines is difficult because heterogeneous users and services access safety-critical resources under time-varying cyber-physical risk that static RBAC/ACL rules cannot capture. This study presents HGRAD, a heterogeneous-graph risk-adaptive access control framework for industrial cyber-physical systems. HGRAD models each access event as a dynamic graph with four node types: user nodes encode operator identity, role, and history; interface nodes represent exposed PLC/MES/service access points and protocol/load states; resource nodes denote commands, records, or work-order objects with different sensitivities; and physics-informed risk nodes provide conservative structural-risk proxies for critical resources. A Temporal-HGT encoder and relation-specific hierarchical attention capture temporal context, structural semantics, and abnormal-path salience, while an intervention-inspired log-based filter, adversarial perturbation, Shapley audit weighting, and MC-Dropout uncertainty estimation support adaptive authorization rather than fixed-threshold decisions. In the TON_IoT benchmark mapping, the physics-informed node is derived only from benchmark-log proxy signals, including access intensity, operation criticality, freshness, and resource criticality; it is not generated by real mine ventilation sensors, plant-side finite-element outputs, or field digital-twin measurements. HGRAD achieves the strongest validation and held-out benchmark performance among compared baselines. The results are therefore benchmark-level proof of concept for access-control design, not evidence of completed industrial deployment or field-validated mine-safety performance.</p>