Reorg access control 1320

Ready for merge.