Based on ongoing work in the Aletheia project on service-oriented information federation, authors present a case study on applying RBAC (Role Based Access Control) for information sharing among multiple stakeholders in the industrial service sector. We place a special emphasis on the methodical, tool-supported elicitation and definition of RBAC policies in this environment.