A role-based delegation constraint method was introduced by separating role into two parts for fine-grained controlling. Three types of delegation constraints were analyzed

including temporal

prohibition and obligation. Using these constraints

conditional delegation and constrained usage was described. The former protected accepted delegation under certain conditions against diffuseness and abuse. The later constrained the usage of permission to avoid abuses of delegated permissions. An algorithm based on the graph theory for verifying the consistency of delegation constraints was presented

which had the time complexity of O（n2）.