Best Practices for Access Control Systems