Separation of duty using high water marks | IEEE Conference Publication | IEEE Xplore