protect flag api with access control, strict error mapping (P-264006)