Design security policy and authentication mechanism

The security policy should define who access to what (departments.
chairs, dean office, registration office, human resources,
students, TAs etc). Your answer may vary depending on the
logical explanation that you provide.
Design an authentication mechanism that is immune to over
the shoulder attacks. You must demonstrate the robustness of
your design through implementation. While there are several
works in this area, you need to outline how your design is
different and what are the improvements.