Susan Stepney Stephen P. Lord Formal Specification of an Access Control System. 575-593 1987 17 Softw., Pract. Exper. 9 db/journals/spe/spe17.html#StepneyL87 http://dx.doi.org/10.1002/spe.4380170903