Escape from the matrix: lessons from a case-study in access-control requirements