A method comprising: receiving, by a security evaluation computer, access data from a user device of a user during an access request; analyzing, by the security evaluation computer, the access data using authentication rules that each specify one of a plurality of authentication protocols for authenticating the user or the user device, wherein at least one of the authentication rules specifies a security level flag for when no authentication is to be performed; triggering, by the security evaluation computer, a first authentication rule corresponding to a first authentication protocol of the plurality of authentication protocols; implementing, by the security evaluation computer, the first authentication protocol; sending, by the security evaluation computer, an authorization request message to an authorization server in a manner consistent with the first authentication protocol; receiving, by the security evaluation computer, an authorization response message; and analyzing, by the security evaluation computer using authorization rules, the access data and the authorization response message to determine whether to complete the access request, wherein implementing the first authentication protocol further comprises: determining that the authentication rules of the first authentication protocol specify a security level flag for when authentication is to be performed; generating an authentication request message comprising a request to authenticate the user or the user device according to the first authentication protocol as indicated by the security level flag for when authentication is to be performed; sending the authentication request message to an authentication server, wherein the authentication server authenticates the user or the user device according to the first authentication protocol and generates an authentication response message including authentication data indicating whether or not the user or the user device is authenticated; receiving the authentication response message; and including the security level flag for when authentication is to be performed and the authentication data into the authorization request message. receiving, by a security evaluation computer, access data from a user device of a user during an access request; analyzing, by the security evaluation computer, the access data using authentication rules that each specify one of a plurality of authentication protocols for authenticating the user or the user device, wherein at least one of the authentication rules specifies a security level flag for when no authentication is to be performed; triggering, by the security evaluation computer, a first authentication rule corresponding to a first authentication protocol of the plurality of authentication protocols; implementing, by the security evaluation computer, the first authentication protocol; sending, by the security evaluation computer, an authorization request message to an authorization server in a manner consistent with the first authentication protocol; receiving, by the security evaluation computer, an authorization response message; and analyzing, by the security evaluation computer using authorization rules, the access data and the authorization response message to determine whether to complete the access request, wherein implementing the first authentication protocol further comprises: determining that the authentication rules of the first authentication protocol specify a security level flag for when authentication is to be performed; generating an authentication request message comprising a request to authenticate the user or the user device according to the first authentication protocol as indicated by the security level flag for when authentication is to be performed; sending the authentication request message to an authentication server, wherein the authentication server authenticates the user or the user device according to the first authentication protocol and generates an authentication response message including authentication data indicating whether or not the user or the user device is authenticated; receiving the authentication response message; and including the security level flag for when authentication is to be performed and the authentication data into the authorization request message. determining that the authentication rules of the first authentication protocol specify a security level flag for when authentication is to be performed; generating an authentication request message comprising a request to authenticate the user or the user device according to the first authentication protocol as indicated by the security level flag for when authentication is to be performed; sending the authentication request message to an authentication server, wherein the authentication server authenticates the user or the user device according to the first authentication protocol and generates an authentication response message including authentication data indicating whether or not the user or the user device is authenticated; receiving the authentication response message; and including the security level flag for when authentication is to be performed and the authentication data into the authorization request message.