The Business Case for Role-Based Access Control by Edward J. Coyne & John M. Davis