Framework for flexible access control