University of Udine
The definition and management of access rules (e.g., to control the access to business documents and business functions) is an important task within any Enterprise Information Systems (EIS). Many EIS apply Role-Based Access Control (RBAC) mechanisms to specify access rules based on organizational models. However, only little research has been spent on organizational changes even though they often become necessary in practice. Examples comprise the evolution of organizational models with subsequent adaptation of access rules or direct access rule modifications. In this paper, the authors present a change framework for the controlled evolution of access rules in EIS. Specifically, they define change operations which ensure correct modification of access rules.