An example method comprises: receiving, at the server from a first client device, a request for access to a client feature on the first client device; determining, by the server, an applicable rule for the access request, the applicable rule having a plurality of nodes; determining, by the server, device capabilities needed for the determined rule; determining, by the server, nodes that can be executed and nodes that cannot be executed, based on the device capabilities; executing, by the server, nodes that can be executed to reach a partial decision for the applicable rule; pruning the rule to remove executed nodes and generate a pruned rule that includes nodes that cannot be executed; transmitting the pruned rule and partial decision to the device. The pruned rule is executed on the first client device with partial decision to generate a final decision. The client feature is configured based on the decision.