Access control refactoring (#11217)

Change-Id: Ied138306cd2b6ccb1c7df59211d3741408e900a2