Current scientific workflow models require datasets to be transferred from their source to the hosts where they can be processed. This seriously impedes data-intensive applications. In order to address this limitation, we propose a notion of mobile tasks that can move from their home hosts towards datasets and perform computation on the dataset side. Since a mobile task might migrate across various administrative domains and get executed at multiple hosts, it is critically important to ensure the security of a mobile-task- based workflow system. In this paper, we propose an itinerary-based access control model to ensure the secure migration of mobile tasks.