What three general criteria define the logical access policy of an organization? And what are their implications?