The article researches models based on RBAC, and then introduces several design principles, aiming to solve the security problems of a web system. Finally, the article designs an extended privilege management model in a real project using the structure of FleaPHP.