Add allow_if option for more flexible acess control