Abstract: The prerequisite conditions （PC） defined in role assignment and revocation mechanisms of URA97 only restrict roles of the assigned users, but not those of other users in the system. This results in assignments conflicts, which is a serious flaw of URA97. The concept of system PC （SPC） is presented in the SPC based authorization model （SBAM） for the first time, and role assignment and revocation mechanisms are redefined, which overcomes the flaw of URA97. SBAM can enforce security policies perfectly in secure systems, and satisfy practical requirements better than URA97