The President as head of State is the ultimate authority on access and need to know. Any attempt by Congress to create a law to curtail this authority would be an unconstitutional attempt by one branch of government to dictate the behavior of another independent branch.

If the President is not the ultimate authority, who is? Congress? An unelected bureaucrat? If this can be true for matters of security classification, then what stops it being true for everything?