How Attribute-Based Access Control Helps You Write Better Authorization Rules