How can I handle acceptance/rejection for subscribe requests?

The idea is to apply 'rights' on users, and make for instance user1 able to subscribe to user2's presence (eg a colleague) but unable to subscribe to user3's presence (eg the company boss)? 

I currently have two ideas of doing so, but none fully satisfies me because they're dirty tricks and not built-in. My ideas:

1/ handle user directory with xml_curl => when sending the request with sip_auth_method=SUBSCRIBE I check From/To and the rights: if allowed I reply the user profile, otherwise I reply "not found" (erf! what sip-level trick...)

2/ write an external script that subscribe to freeswitch events related to presence, accept any subscription, after each successful subscription the script checks the database entry: if allowed don't touch anything, if not allowed then delete the entry from the db (super-erf! db-level trick)

Would there be other solutions that I would have missed? I mean, proper and clean solutions.

Thanks a lot for your help :)

Florent