Clustering subjects in a credential-based access control framework