Abstract: Workflow management systems (WFMS) has been widely used in organizational business process management of enterprises and government, and role-based access control (RBAC) model is generally adopted in system tasks for solving the problem of authorization control, and performs good adaptability to the changes of employees; roles or departments. However, with the intensification of competition and the normalization of reform, the organization structures and roles are changing more and more frequently, thus a process system implemented to different organizations will face with much more serious variety of organization structures and roles. The RBAC model causes the task authorization in the business process definition to be heavily organization-dependent, thus the frequent changing of organization will require continuous changing of authorization system, or even worse, lead to its abnormal execution due to the improper process definition. For this problem, this paper proposes a position-role based access control (PRBAC) model, which divides the granularity of roles into organization positions, introduces the concept of business roles which are the only authorization objects, and establishes the corresponding relationship through a mapping layer. The equivalence of PRBAC and RBAC in expressivity is proved, and the granularity and complexity of authorization are analyzed. Through case analysis, we demonstrate that PRBAC model can effectively improve the adaptability and flexibility of WFMS in organizational changes, and realize the decoupling of organization model and business model.

Key words: workflow, PRBAC model, organization position, business role, authorization