Abstract: An access control paradigm composed of basic model and role model is proposed for collaborative applications.Basic model specifies the relationship among privileges and the way of ranking privileges.It relates privilege with operationson the objects‚so the model appears more straight forward. Moreover‚if Brokers’implementation permits‚the model can support any grained access control.Role model re-defines the role concept of RBAC96‚divides the permissions of role into public permissions‚ protect permissions and private permissions.It allows user to define roles more flexibly‚prevents private permissions of roles from being inherited and reduces the definition of ancillary roles.