updated access-rule to take explicit names for method, url, and params