access check done by node_access