As there are always changes in trust level, organization structure, attributes of the subject, time strategy and so on, which will cause subject pemissions' change. The traditional static authorization based access control model is not appropriate in this condition. In this paper, a model which can support dynamic authorization according to these changes is discussed. This model not only has strong ability to describe the requirements from users and application systems, but also has enough flexibility to capture the changes of subject's attribute, organization structure, trust value, time strategy, and based on these to do dynamic authorization.