add acl api in access (closes #3544)