Revisiting Your Authentication Control Framework