Risk-based access control raises some novel problems that have not yet been investigated. In particular, the ability to aggregate uncertain risk estimations from different experts is crucial to the success of risk-based access control systems. A K-Algebra is proposed in this paper for this purpose. The algebra is not only able to support the specification of existing aggregation rules but also makes it possible to generalize these rules based on their logical explanations.