If you can use an algorithm, and you do not have to share the logic, you might as well just make the algorithm return "denied" every time.