can be complex, but allows different access levels based on user attributes, EG IP address, beheviour