Evaluating access control policies through model checking
Alcoa: the alloy constraint analyzer