Access control by attribute value of bound user?