Formal access control model defined in terms of application structure?

security.stackexchange.com