Client controlled Network access ... any experience?

[Kevin Kinsey]

Greetings,

I'm looking at a situation which I imagine is common to many institutions,
in which I'll want to have a small LAN with full access to LAN resources,
but not allowing any gateway access unless a "supervisor" type person
authorizes the excursion.

What should I consider?  A proxy server?  A configurable firewall script?
I could probably write something, script-wise, that might be workable on
the LAN webserver ...

I'm certain the gateway, and perhaps some of the clients, will be FBSD;
but there are already Winboxen on the LAN, and we may want to extend
"protection" to these as well....

Anyone with a brief word of Wisdom?  (Perhaps like, "what the heck to
Google for" ??)

TIA,

Kevin Kinsey