Workflow Management System is used for supporting many day-to-day workflows in large organizations. But heterogeneous and distributed computing systems make security management of WFMS decentralized, thus its security must be noticed. In this paper, we propose a role-based secure workflow model which realizes the principle of separation of duties (SoD), the principle of least privilege, integrity, authorization and availability. We also portray the whole model as a multi-layered architecture with a multilayered state graph for expressing and analyzing the flow of authorization. The layers are, respectively, role layer, task layer, control layer and data layer.