Creating an object based on the subclasses of two other objects

My design problem is as follows.

I have two classes, each with a number of subclasses. I have a factory, which needs to create an object based on the subclass of each of these objects.

This is an authentication problem. The factory generates a rule object based on the type of person and the type of resource they wish to access. The rule has alwaysAllow, NeverAllow and timeBasedAllow subclasses. With the potential for more if a more complex access system is needed in the future.

So in future ideally a new person could be created with a new subclass, a new resource with a new subclass. The parameters on which access is determined could be changed with a new rule subclass, and the specific access of each person type and room type could be changed within the rule factory.

So far the only way I can think to do this would be to have an enumeration inside the subclasses, which defeats the point because then adding a new person or room requires a new class and a change in the enum class which seems messy.

I also am very keen to keep the data and the logic separate so I can’t just move authentication methods into the person class because this would require the person class to know how many room types there were, which is definitely not ideal.

I may be after something that isn’t realistically achievable but I can’t help the feeling that there is a nice clean solution just out of my grasp.

Any help would be greatly appreciated.