Beyond separation of duty: an algebra for specifying high-level security policies