A request to obtain data items associated with an entity is received from a client device. One or more computing devices determine whether access to the data items is restricted by an access control policy and whether the client device complies with the access control policy. In response to determining that the client device complies with the access control policy, at least a portion of the data items that the access control policy permits the client device to access are identified. An integration of the at least a portion of the data items with additional data items is initiated.