access control prototypes

command line also work to go via generic extensions interface