Rethinking Segregation–of–Duties Systems