finished AccessControlQueryBuilder (non tested)