A framework for risk assessment in access control systems
Risk-based security decisions under uncertainty