add TODO-comments to handle/store/pass access-grant