Design access control right from the start, or waste years fixing it later