Specification and classification of role-based authorization policies

Constraints are an important aspect of role-based access control (RBAC). Although the importance of constraints in RBAC has been recognized for a long time, they have not received much attention. In this paper we classify RBAC constraints into two major classes called prohibition constraints and obligation constraints. To specify these constraints, we utilize a formal language, named RCL2000. In this paper we show that prohibition, cardinality, and obligation constraints can be also represented in RCL2000.