[CX] Admission control

We need a (probably very simple) way to control the access to the cluster resources (e.g. reject requests if they probably cannot be satisfied).