add checkAccess to RBAC