  Usage control models provide an integration of access control, digital
rights, and trust management. To achieve this integration, usage control models
support additional concepts such as attribute mutability and continuity of
decision. However, these concepts may introduce an additional level of
complexity to the underlying model, rendering its definition a cumbersome and
prone to errors process. Applying a formal verification technique allows for a
rigorous analysis of the interactions amongst the components, and thus for
formal guarantees in respect of the correctness of a model. In this paper, we
elaborate on a case study, where we express the high-level functional model of
the UseCON usage control model in the TLA+ formal specification language, and
verify its correctness for <=12 uses in both of its supporting authorisation
models.
