An access control system (100, 100') comprising an access decision component and a validation module, wherein the validation module comprises: modular communication interfaces that provide coupling to the access control system (100, 100'); at least one processor; and a computer readable storage medium storing executable code that is executable by the at least one processor, the computer readable storage medium including: executable code that receives cardholder data in connection with an access request at an access point controlled by the access control system (100, 100'); executable code that validates the cardholder data; executable code that extracts ID information from the validated cardholder data; executable code that sends the extracted ID information to the access decision component of the access control system (100, 100'), and executable code that determines whether an attribute, that is not on the access control system (100, 100'), corresponding to a cardholder of the cardholder data is present on a database that is separate from the access control system (100, 100'); and wherein the access decision component comprises: at least one processor; and a computer readable storage medium storing executable code that is executable by the at least one processor, the computer readable storage medium including: executable code that determines whether access is granted for the cardholder, wherein, even if the cardholder would not be granted access through default behavior of the access control system (100, 100') based on local authority of the access control system (100, 100'), access is granted to the card holder if the attribute indicates an override of the default behavior. modular communication interfaces that provide coupling to the access control system (100, 100'); at least one processor; and a computer readable storage medium storing executable code that is executable by the at least one processor, the computer readable storage medium including: executable code that receives cardholder data in connection with an access request at an access point controlled by the access control system (100, 100'); executable code that validates the cardholder data; executable code that extracts ID information from the validated cardholder data; executable code that sends the extracted ID information to the access decision component of the access control system (100, 100'), and executable code that determines whether an attribute, that is not on the access control system (100, 100'), corresponding to a cardholder of the cardholder data is present on a database that is separate from the access control system (100, 100'); and executable code that receives cardholder data in connection with an access request at an access point controlled by the access control system (100, 100'); executable code that validates the cardholder data; executable code that extracts ID information from the validated cardholder data; executable code that sends the extracted ID information to the access decision component of the access control system (100, 100'), and executable code that determines whether an attribute, that is not on the access control system (100, 100'), corresponding to a cardholder of the cardholder data is present on a database that is separate from the access control system (100, 100'); and at least one processor; and a computer readable storage medium storing executable code that is executable by the at least one processor, the computer readable storage medium including: executable code that determines whether access is granted for the cardholder, wherein, even if the cardholder would not be granted access through default behavior of the access control system (100, 100') based on local authority of the access control system (100, 100'), access is granted to the card holder if the attribute indicates an override of the default behavior.