{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:40:25Z","timestamp":1755823225526,"version":"3.44.0"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,15]],"date-time":"2023-11-15T00:00:00Z","timestamp":1700006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Swiss National Science Foundation","award":["204796"],"award-info":[{"award-number":["204796"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,15]]},"DOI":"10.1145\/3576915.3623196","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:35:13Z","timestamp":1700570113000},"page":"2830-2844","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Is Modeling Access Control Worth It?"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2952-939X","authenticated-orcid":false,"given":"David","family":"Basin","sequence":"first","affiliation":[{"name":"ETH Z\u00fcrich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2161-308X","authenticated-orcid":false,"given":"Juan","family":"Guarnizo","sequence":"additional","affiliation":[{"name":"ETH Z\u00fcrich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8314-2589","authenticated-orcid":false,"given":"Sr\u0111an","family":"Krstic","sequence":"additional","affiliation":[{"name":"ETH Z\u00fcrich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4217-0983","authenticated-orcid":false,"given":"Hoang","family":"Nguyen","sequence":"additional","affiliation":[{"name":"ETH Z\u00fcrich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7816-5775","authenticated-orcid":false,"given":"Mart\u00edn","family":"Ochoa","sequence":"additional","affiliation":[{"name":"Zurich University of Applied Sciences, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,11,21]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Amazon. 2023. Cedar Authorization Language. https:\/\/www.cedarpolicy.com\/en."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2003.1231149"},{"key":"e_1_3_2_1_3_1","unstructured":"Authorize. 2023. Flask Authorize Authorization library. https:\/\/flask-authorize.readthedocs.io\/en\/latest\/."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2008.05.011"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2013.2297116"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1125808.1125810"},{"key":"e_1_3_2_1_7_1","unstructured":"David Basin Juan Guarnizo Srdjan Krsti\u0107 Hoang Nguyen and Mart\u00edn Ochoa. 2023. Case study web application for access control implementation. https:\/\/anonymous.4open.science\/r\/MDS-study-7546."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.55"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10270-004-0061-2"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-69100-6_22"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-49435-3_22"},{"key":"e_1_3_2_1_12_1","unstructured":"Flask. 2023. Flask Web Framework. https:\/\/flask.palletsprojects.com\/en\/2.3.x\/."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560569"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2014.83"},{"key":"e_1_3_2_1_15_1","unstructured":"Object Management Group. 2014. Object Constraint Language (OCL) 2.4 Specification. https:\/\/www.omg.org\/spec\/OCL\/2.4\/."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2925422"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1026586415054"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2600176.2600204"},{"key":"e_1_3_2_1_19_1","volume-title":"MDA explained - the Model Driven Architecture: practice and promise","author":"Kleppe Anneke","year":"1944","unstructured":"Anneke Kleppe, Jos Warmer, and Wim Bast. 2003. MDA explained - the Model Driven Architecture: practice and promise. Addison-Wesley, USA. http:\/\/www.informit.com\/store\/mda-explained-the-model-driven-architecture-practice-9780321194428"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1999.816038"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45800-X_33"},{"key":"e_1_3_2_1_22_1","unstructured":"Microsoft. 2023. Policy-based authorization in ASP.NET Core. https:\/\/learn.microsoft.com\/en-us\/aspnet\/core\/security\/authorization\/policies."},{"key":"e_1_3_2_1_23_1","unstructured":"OSO. 2023. Flask OSO Authorization library. https:\/\/docs.osohq.com\/python\/reference\/frameworks\/flask.html."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533703"},{"key":"e_1_3_2_1_25_1","unstructured":"Principal. 2023. Flask Principal Authorization library. https:\/\/pythonhosted.org\/Flask-Principal\/."},{"key":"e_1_3_2_1_26_1","unstructured":"Open Worldwide Application Security Project. 2021. OWASP Top 10. https:\/\/owasp.org\/Top10\/."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.28945\/314"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978382"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.82"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1975.9939"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.85"},{"key":"e_1_3_2_1_32_1","unstructured":"SQLAlchemy. 2023. Flask SQLAlchemy SQL toolkit and Object Relational Mapper. https:\/\/flask-sqlalchemy.palletsprojects.com\/en\/2.x\/."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1414004.1414055"},{"key":"e_1_3_2_1_34_1","unstructured":"User. 2023. Flask User Authentication Library. https:\/\/flask-user.readthedocs.io."},{"key":"e_1_3_2_1_35_1","unstructured":"Vaadin. 2023. Vaadin Web Framework. https:\/\/vaadin.com\/."},{"key":"e_1_3_2_1_36_1","volume-title":"Fix It. In 29th USENIX Conference on Security Symposium (SEC). USENIX Association, USA, Article 7, 18 pages.","author":"Votipka Daniel","year":"2020","unstructured":"Daniel Votipka, Kelsey R. Fulton, James Parker, Matthew Hou, Michelle L. Mazurek, and Michael Hicks. 2020. Understanding Security Mistakes Developers Make: Qualitative Analysis from Build It, Break It, Fix It. In 29th USENIX Conference on Security Symposium (SEC). USENIX Association, USA, Article 7, 18 pages."},{"key":"e_1_3_2_1_37_1","unstructured":"WIRED. 2019. Hack Brief: 885 Million Sensitive Financial Records Exposed Online. https:\/\/www.wired.com\/story\/first-american-data-exposed\/."}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Copenhagen Denmark","acronym":"CCS '23"},"container-title":["Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3623196","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3576915.3623196","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T01:43:36Z","timestamp":1755740616000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3576915.3623196"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,15]]},"references-count":37,"alternative-id":["10.1145\/3576915.3623196","10.1145\/3576915"],"URL":"https:\/\/doi.org\/10.1145\/3576915.3623196","relation":{},"subject":[],"published":{"date-parts":[[2023,11,15]]},"assertion":[{"value":"2023-11-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}