With the growing popularity of web GIS,we need to enhance the security of the service-oriented spatial data infrastructure (SDI).To avoid exploiting the geospatial data to the unauthorized users,a formal access control model formulti-granularity control and spatial-temporal-based control is needed.Because traditional access control models cannot meet spatial control requirements,we propose a new spatial access model,MSVAC based on RBAC.We add attributes and constraints on each component of RBAC,the attributes of this model are: user’s location attribute,the time and location attributes of roles,the scale attribute constraint of geographic layers,the geometry and semantic attribute constraints of geographic features,the field attribute constraint of feature views.We formalize the above attributes and constraints with which MSVAC can implement multi-granularity spatial access control in certain period.Finally,we achieve the MSVAC in a web GIS,examples of the verification system show the positive or negative authorization indifferent data granularity control and time control,which can achieve all the spatial access control requirements.