The Triple-A Approach to Role Based Access Control and Device Security