Understanding User Permissions in Access Control Systems