Fine-Grained Authorization Services in Virtual Organizations: Refined Access-Control Decision Making in Large Institutions