Which access specifier allows a derived class to access a member, but keeps it hidden from code outside the class hierarchy?