iRule to select different access profile based upon host header?

You can only apply one access profile per virtual sever, so you will have to use layered virtual servers.

For example, having one Virtual Server, acting as a broker, then use an iRule to select the virtual server, with the associated access policy based on the required host header

This can be done using a simple switch statement, but does need to have multiple Virtual Servers.

when HTTP_REQUEST {
    switch [string tolower [HTTP::host]] {
        "www.site1.com" {
            virtual site1_vs
        }
        "www.site2.com" {
            virtual site2_vs
        }
        "www.site3.com" {
            virtual site3_vs
        }
}