A logical framework for reasoning about access control models