Access control is an important aspect of regulatory compliance. Therefore, access control specifications must be process-aware in that they can refer to an underlying business process context, but do not specify when and how they must be enforced. Such access control specifications are often expressed in terms of general rules and exceptions,
akin to defeasible logic. In this paper we demonstrate how a role-based, process-aware access control policy can be specified in the SBVR.