Allowing authentication to only specific taps?

In my scenario it would be amazing to allow NFC-authenticated users access to only a specific tap (or to disallow access to a tap.) My kegerator is in a public location (in the shed at a campground) and my motivation to build out a kegbot was to secure the taps from underage walk-ups. I’d love to be able to give my kids NFC tags so they can pour root beer, but not provide access to the beer tap.

Has anyone done or considered this? I’ve tried to take a look at the code but at this point it’s a little beyond my skill level. I can’t seem to find where those authentication/relay unlock calls even come from.