Limitations of current access control design