Abstract: A physical access control system (PACS) for protecting a resource The PACS including a credential including information regarding a user stored thereon, the credential presented to request access to a resource protected by an access point, a reader in operative communication with the credential and configured to read the user information from the credential, wherein the user information includes at least one attribute, and a controller executing a set of access control rules, the rules based on policies extracted from a database of static permissions for the user, the policies defining requirements for permitting access of the user to the resource based on the at least one attribute, the controller configured to permit access to the resource.