Why? I'd suggest dropping (2) entirely and leaving (1) as constrained as possible. The agency's opinion that a use violates a law (compare to: a court has ruled that a use violates a law) should not be an acceptable reason to deny access. Whatever policy the agency uses in (1) should be clear and not capricious.