Simon N. Foley Separation of Duty using High Water Marks. 79-88 1991 CSFW db/conf/csfw/csfw1991.html#Foley91