Michael Drouineaud Maksym Bortin Paolo Torrini Karsten Sohr A First Step Towards Formal Verification of Security Policy Properties for RBAC. 60-67 2004 conf/qsic/2004 QSIC http://csdl.computer.org/comp/proceedings/qsic/2004/2207/00/22070060abs.htm db/conf/qsic/qsic2004.html#DrouineaudBTS04