Access control models are typically very coarse-grained, allowing one access to a resource (possibly with some combination of read/write/execute permission) or exclude such access. Some models of database security allow access to be granted on a per row basis (though I don't have a reference handy).
Have fine-grained access control models been designed to limit access to parts of an XML document? What could/should a model look like? Has any work been done in this area? Are other security models applicable in this context?
For example, one could imagine that the model prevents access to a particular subtree. The subtree could either be removed or encrypted.
Note that this need not explicitly apply to XML. Any models devised for semi-structured data are also interesting.