Modern Web sites provide multiple services that are often deployed through distributed architectures. The importance and the economic impact of Web-based services introduces significant requirements in terms of performance and quality of service. In this paper, we propose an access control mechanism for dynamic, Web-based systems. The proposed architecture takes into account two goals: the service of all requests pertaining to an admitted session until system saturation, and a graceful, controlled degradation of performance in case of overwhelming user request loads. The session-oriented behavior is obtained through an admission control mechanism that denies access to requests starting new sessions if the system is judged as overloaded. Graceful degradation is achieved through the refusal of single requests with increasing priority. Static priorities, determined for example, by the user category (guest, member, gold) are taken into account first. If the system is still in overload, the access control mechanism evaluates dinamically the popularity of single requests, and drops the least popular requests.