Safety Analysis of the Usage Control Authorization Model