Enforcing Role-Based and Category-Based Access Control In Java: A Hybrid Approach