For interoperability, e-documents are usually transformed to XML structure for exchange via the Internet. However, a large number of XML documents may cause managerial problems, such as users’ access rights, in an organization. Role-based access control models provide a good administration and can be applied to many different applications easily, such as LDAP service (Yeh et al., 2002), e-document workflow system and so on. A role-based access control model with role hierarchy is easy to implement also in an XML (eXtensibel Markup Language) (World Wide Web Consortium, 2000) document with a hierarchical data model. In this study, we applied this hierarchical characteristic to design a role-based access control sheet, called XML Role-based Access Sheet (XRAS). XRAS can show the relationship, between user–role and permission-role assignments very clearly. To reduce assigning duplicate authorization, we also refer to the relative addressing (Ray, 2001) of Xpointer (XML Pointer Language) (World Wide Web Consortium, 2001) to limit the inherited authorization scope. This is an easy and efficient way to reduce the heavy burden for security administrators in an organization.