Differentiated Service (DiffServ) architecture has been proposed as a scalable QoS architecture for Internet. DiffServ, however, could not control its loads under heavy traffic conditions, and it could not provide strong QoS responses for individual traffic flow. This paper introduces at the edges of a DiffServ domain, a novel two-level admission control scheme, the Fair Intelligent Admission Control (FIAC). At per-class level, FIAC admits traffic according their fairshare and usage while preventing possible congestion within the DiffServ core. At per-flow level, FIAC estimates and allocates the fairshare for each flow within a class. Simulation results demonstrate that FIAC adheres extremely well to the bandwidth requirements of DiffServ classes while preventing congestion within the DiffServ core. With FIAC's per-flow level enabled, FIAC is able to prevent uncontrolled UDP flows from depriving TCP-controlled flows of bandwidth share when they are aggregated to the DiffServ domain.