Analyzing workflows implied by instance-dependent access rules