[UPDATE] separate acl check