complete access control for cli