W-RBAC - A Workflow Security Model Incorporating Controlled Overriding of Constraints

This paper presents a pair of role-based access control models for workflow systems, collectively known as the W-RBAC model. The models described here contains both static and dynamic (history based) constraints, which is integrated with a workflow system. The W0-RBAC model describes our concept of dynamic constrains, and the integration of the access control system with the workflow. The W1-RBAC model extends the W0-RBAC model by allowing for a controlled overriding of constraints, which we argue are necessary in workflow applications in order to cope with exceptional situations. Finally we discuss a Prolog implementation of the access control models.

2001