Rule-based authorization mechanism