Formal access control model defined in terms of application structure?security.stackexchange.com 1jimwhitson14ydiscuss