DISCO - A Discretionary Security Model for Object-oriented Databases