This paper presents an approach that uses special purpose
RBAC constraints to base certain access control decisions on
context information. In our approach a context constraint
is defined as a dynamic RBAC constraint that checks the
actual values of one or more contextual attributes for pre-
defined conditions. If these conditions are satisfied, the cor-
responding access request can be permitted. Accordingly, a
conditional permission is an RBAC permission which is con-
strained by one or more context constraints. We present an
engineering process for context constraints, that is based on
goal-oriented requirements engineering techniques, and de-
scribe how we extended the design and implementation of an
existing RBAC service to enable the enforcement of context
constraints. With our approach we aim to preserve the ad-
vantages of RBAC, and offer an additional means for the def-
inition and enforcement of fine-grained context-dependent
access control policies.