Policy Models (3)
	• Typical Business – Managers can (usually) grant rights to their staff – Information is visible to people above in the organization – Managers do not have authority to grant access downward for some classes of information – Overall control is maintained by restricting access to applications rather than to data – databases have their own distinct access controls