Consistency Checks for Duties in Extended UML2 Activity Models

Process-aware information systems support the execution of business processes. Organizations require the precise specification of security policies that govern the behavior of subjects in these systems. Thereby, obligation policies specify duties to be fulfilled by certain subjects. In organizational contexts, duties are often associated with a certain task in a business process. In this paper, we further elaborate two UML2 extensions which provide modeling support for roles, tasks, and duties in a business process context. In particular, we introduce the notion of mutual exclusion and binding constraints for duties in process-related RBAC models. Furthermore, we formally define respective consistency checks for design-time and runtime models.