Server-side decision

Match credentials, declarations and preferences against:
- Access control policy.
- Privacy policy.
Are conditions from server's access control policy fulfilled?
Are user preferences acceptable?