John McDermott Leo Freitas A formal security policy for xenon. 43-52 2008 FMSE http://doi.acm.org/10.1145/1456396.1456401 conf/ccs/2008fmse db/conf/ccs/fmse2008.html#McDermottF08