A query component to enforce ACLs