Verification and change-impact analysis of access-control policies