A Review of Delegation and Break-Glass Models for Flexible Access Control Management

Abstract. Access control models provide an important means for the system-atic specification and management of the permissions in a business information system. While a number of well-known access control models exists (such as the role-based access control model, for example), standard access control models are often not suited for handling exceptional situations. In this context, the demand to increase the flexibility of access management has especially been approached via the development of delegation models and break-glass models. This paper presents the results of a literature review for 329 delegation and break-glass approaches. We give an overview on the existing body of scientific literature in these two areas and compare 35 selected approaches in detail. In our literature review, we revealed different ways of providing delegation and break-glass concepts in general as well as in the context of business process management. Moreover, we identified different sub-topics that have not yet been addressed in detail and thus provide opportunities for future research