We present a new approach to ensure the secure execution of itinerary-driven mobile agents, in which the specification of the navigational behavior of an agent is separated from the specification of its computational behavior. We empower each host with an access control policy so that the host will deny the access from an agent whose itinerary does not conform to the host?s access control policy. A host uses model checking algorithms to check if the itinerary of the agent conforms to its access control policy written in ?-calculus, and if so, grant access permission. In order to address the state explosion problem for model checking itineraries, we propose an approach called Model Generation Code. In this approach, instead of verifying the itinerary itself, a host actually checks the conservative models of a mobile agent. If a conservative model does not satisfy the host?s access control policy, the mobile agent will provide refined models for further verification. Our preliminary results show that this is a practical and promising approach to ensure the secure execution of mobile agents.