The Business Process Modeling Notation (BPMN) has become a defacto standard for describing processes in an accessible graphical
notation. The eXtensible Access Control Markup Language (XACML) is an OASIS standard to specify and enforce platform independent
access control policies.
In this paper we define a mapping between the BPMN and XACML meta-models to provide a model-driven extraction of security
policies from a business process model. Specific types of organisational control and compliance policies that can be expressed
in a graphical fashion at the business process modeling level can now be transformed into the corresponding task authorizations
and access control policies for process-aware information systems.
As a proof of concept, we extract XACML access control policies from a security augmented banking domain business process.
We present an XSLT converter that transforms modeled security constraints into XACML policies that can be deployed and enforced
in a policy enforcement and decision environment. We discuss the benefits of our modeling approach and outline how XACML can
support task-based compliance in business processes.
Keywords Policy Definition - Integration - Enforcement - Separation of Duties Business Process Modeling - eXtensible Access Control Markup Language