A graph-based framework for the analysis of access control policies