Evaluating access control policies through model checking
security engineering - a guide to building dependable distributed systems .