wip: access control annotations