Phase 3: Decide Who Needs Access