An access control service for dynamic and hierarchical resources: Declarative model and implementation on top of XACML