Abstract: The traditional access control mechanism is bonded with the security policy it supports and can only support one policy. In order to establish a kind of access control mechanism supporting multiple polices, the meta-policy concept was introduced. By using the meta-policy description framework and the security policy model based on the meta-policy concept, a method of building flexible access control mechanism was put forward, which made the access control mechanism separate the security policy from the policy decision function and could dynamically support multiple security policies. The method is implemented in a CORBA-based system and the test results show that it is effective.