An access control model for querying XML data