Techniques are provided for controlling access message flow. The techniques include receiving one or more access messages; determining one or more sets of features, one for each access message; receiving a particular access message; determining a particular set of one or more features for the particular access message; determining whether the particular access message satisfies a particular condition based on the particular set of one or more features and the one or more sets of features; and if the particular access message satisfies the particular condition, performing a responsive action based on the particular condition.