access control on the thingie whatsit