Because we do not need to implement a variety of specific conflict resolution algorithm with CRM, we are easy to add or maintain constraints when security requirements change. In practice, CRM can deal with all of the constraints related to RBAC. First, we take one mutually exclusive constraint for example. In the running example, we do not allow U7 that belongs to two different roles. The ASP program for this constraint is (17). The result of this constraint is in Fig. 5(a).