Abstract: Role-based access control models introduced in literature cannot satisfy the requirements of complex system because of using central administration.A new model is introduced through extending RBAC96.This model develops ROLECONTEXT as the criterion of auto-authorization activity.Four ROLECONTEXT components‚namely authorization maximum‚authorization region‚authorization type and revocation type are defined to support flexible and mult-i step authorization.This makes the model permit security manager to control the system at a higher level.Core component and specifications of the new model are given.Moreover‚algorithm for authorization and examples are illustrated.