A no-poetterware desktop RBAC policy