move access permission into access function