An example method comprises: receiving, at a server from a first client device, a request for access to a client feature on the first client device; determining, by the server, an applicable rule for the access request, the applicable rule having a plurality of nodes; determining, by the server, device capabilities needed for the determined rule; determining, by the server, nodes that can be executed and nodes that cannot be executed, based on the device capabilities, the nodes that can be executed including device hardware capabilities and the nodes that cannot be executed including real-time device capabilities; executing, by the server nodes that can be executed to reach a partial decision for the applicable rule; pruning the applicable rule to remove executed nodes and generate a pruned rule that includes nodes that cannot be executed; transmitting the pruned rule and partial decision to the first client device.