An Algebraic Basis for Specifying and Enforcing Access Control in Security Systems