By implementing hook_flag_access() and (hook_flag_access_multiple()) you can decide if it will be possible to use the flag on a certain piece of content (or by a certain user). This will also determine if the flag link will be shown.
This hook exists in Flag 2.x and above only.
This gives you more granular control than the simple access control Flag provides out of the box.
For example, you could decide that flagging a node will only be allowed no longer than one week after the node has been published.
2010-Dec-22: Warning: Our hook_flag_access() API may change before Flag 2.0 is out, so please "subscribe" to the linked issue if you want to be notified about this.
To see an example for implementing this hook see Flag's own implementation (in other words, Flag itself implements this hook --in order to implement the access schemes it provides out of the box).
You'll notice that there are actually two hooks: hook_flag_access() and hook_flag_access_multiple(). The later is used when Flag has several pieces of content. This is used for efficiency: instead of executing some lengthy calculation for each node separately (say an SQL query), some shortcut can be made. (This pattern, of using a "_multiple" hook is also used in Drupal 7's core.)
The Limiting the number of flaggings per day recipe gives another example of implementing this hook.
Here's a simple example that grants a certain user (user #1 in this case) access to a flag as if he were a superuser.
An alternative to hook_flag_access() is to use hook_flag_validate(). It's only a proposed feature at this time. It should be easier to use this proposed hook.