web application access control research

[<absmith () cerias purdue edu>]

All,

Besides the OWASP Guide, can anyone point me to papers/articles that deal 
with the issues of access control of web applications?

I am looking to do a survey paper on this topic.  Basically, I am looking 
for references that talk about access control in regards to web 
applications: current trends, research, tools, software, ideas, etc.

Any help would be great.  Thanks in advance!

- Andy