Access control design: Avoiding a labyrinth of unknown-unknowns