Access control decision function