Rule-set-based access control