Access control based on DB data