The application of traditional role-based access control in the workflow for power systems can reduce the complexity of permission management. However， using the role concept alone can hardly reflect the organizational structure of the enterprise， nor can it specify the organizational unit for a task. Moreover， the permission inheritance relation among roles is not in accord with the reality of the workflow for the power system， with the static access control constraints hardly meeting the dynamic requirements of the workflow. Hence the proposal for an organization-and-task-based access control model. By introducing organizational units and tasks， the model eliminates the permission inheritance relation among roles， divides the tasks into common ones and professional ones， with the former assigned to the organizational unit and capable of being inherited; the latter assigned to roles in the organizational unit and incapable of being inherited. Then permissions are assigned to tasks， while users get task permissions through roles or the organizational unit they belong to. Combined with the model proposed， through adding blacklists data to each task， a dynamic access control algorithm is given. Finally， a specific access control design for the facility maintenance workflow in the substation is presented， showing that the model and algorithm can realize dynamic constraints of separation and binding of duties.