Lawrence H. Cox Modelling and Controlling User Inference. 167-171 1987 DBSec db/conf/dbsec/dbsec87.html#Cox87