On testing for absence of rights in access control models

The well-known access control model formalized by M.H. Harrison, W.C. Ruzzo, and J.D. Ullman (HRU) (1976), does not allow testing for absence of access rights in its commands. R.S. Sandhu´s Typed Access Matrix (TAM) model (1992), which introduces strong typing into the HRU model, continues this tradition. P.E. Ammann R.S. Sandhu (1992), have proposed an extension of TAM called augmented TAM (ATAM), which allows testing for absence of rights. The motivation for ATAM is to express policies for dynamic separation of duties based on transaction control expressions. The authors study the question of whether or not testing for absence of access rights adds fundamental expressive power. They show that TAM and ATAM are formally equivalent in their expressive power. However, their construction indicates that while testing for absence of rights is theoretically unnecessary, such testing appears to be practically beneficial