Relationship-based access control: protection model and policy language
Protection: principles and practice