Access Control With Formal Security Guarantees