The Attribute-Based Access Control (ABAC) security model is widely used in the industrial Internet of Things (IoT) and information integration systems with many business processes and a large number of users and resources. The construction of ABAC policies is typically based on policy engineering techniques, policy mining algorithms, or ABAC specification standards like eXtensible Access Control Markup Language (XACML). While the current top-down policy engineering techniques can ignore some of the useful accesses in the policy design process, the existing policy mining algorithms may lead to the generation of irrelevant ABAC rules to the actual requirements. Also, applying XACML may make the specification of ABAC policies complex and verbose in heterogeneous environments. This paper presents a model-based approach to designing and validating ABAC policies, with the core of the approach being our suggested ABACbase model combined with the previous works. Within our proposed framework, the ABAC policy representation model utilizes Unified Modelling Language (UML) diagrams and the expressive power of Object Constraint Language (OCL) to be able to capture policy-related contextual information and environmental conditions. The ABAC policies are designed from a natural language access control policy (NLACP) document as OCL constraints, and the ABAC defined in an event log is expressed as UML object diagrams. The proposed framework has been experimented with and evaluated on the event sequence of a BtoC e-commerce process applying for residences in Tokyo. As a result, the ABAC conformance issues were detected using a UML and OCL validation tool.