Web services are vulnerable to various types of security attacks. This paper addresses one type of attacks, where applications trying to access services to which they are not authorized. Existing access control for web services lack of support for global services. As such services are WAN-based, therefore access control needed to deal with various levels of web services, including global (for composite services) and local level (for web servers). This paper proposes two access control: SWS-RBAC (for single services) and CWS-RBAC (for global services). Instead of protecting the content of the service's parameters, these models protect the parameters themselves. The proposed approach introduces global roles which are used in the mapping to local roles of other service providers. To maintain the autonomy of roles between providers, an efficient role-mapping mechanism has been proposed accordingly.