A model-driven approach for the visual specification of Role-Based Access Control policies in web systems

Specifying the access policy of a web system is a relevant design concern that is often dismissed or postponed until the implementation. ADM-RBAC (Ariadne Development Method with Role-Based Access Control) is a model-driven approach for web systems that supports the specification of access control policies in an integrated way and at two abstraction levels. At the conceptual level a number of visual models specify the access policy in a way that is similar to the users' point of view. At the detailed level, models are oriented towards providing enough details to generate prototypes in an automatic or semiautomatic way. In this paper we describe the visual models of ADM-RBAC and their empirical evaluation. © 2008 IEEE