Aspects of the present disclosure are directed to controlling access to resources in a network. In an embodiment, a gateway system receives a packet requesting access to a resource in the network, and identifies access control policies to be applied in determining whether or not to permit access to said first resource. The gateway system applies a higher-layer policy and then a lower-layer policy on the packet to determine whether or not to forward the packet to the network and forwards the packet to the network only if it is determined to forward the packet. The higher-layer policy and lower-layer policies are according to respective layers of a networking model.