It really shouldn't be that hard to program these rules. Even for AA card people, there has to be a simple/automated way to extract the needed info from the card itself and validate access.
Auto gates are not even necessary, just a simple program for agents to use (and not deviate from)