Consistency Checks for Duties in Extended UML2 Activity Models

Process-aware information systems support the execution of business processes. In this context, organizations require the precise specification of security policies that govern the behavior of subjects in the systems. Obligation policies specify duties to be fulfilled by certain subjects. In organizational contexts, duties are often associated with a certain task in a business process. In this paper, we further elaborate two UML2 extensions which provide modeling support for roles, tasks, and duties in a business process context. In particular, we introduce the notion of mutual exclusion and binding constraints for duties in processrelated RBAC models. Furthermore, we formally define respective consistency checks for design-time and runtime models. Keywords-Binding of duty; OCL; RBAC; Security; Separation of Duty; UML;