chore(access): Pull most acl logic into an OO service

Refs #3568