added data layer access control (added a new Criterion type)