This paper describes an access control method of the XML repository system, SAXOPHONE, which was implemented at Tokyo Metropolitan University. The main feature of our research is a novel account identifier that is based on the prefix-labeling scheme to realize a hierarchical authorization. SAXOPHONE uses relational databases for XML document storage. Using it, any valid or well-formed XML document is decomposed into events of the SAX parser and is then stored into relational tables using a fixed scheme. Consequently, users can handle the system as a normal SAX parser. This study also illustrates how to realize an access control method of XML documents on relational databases using the account identifier.