filesystem access control: use reference to original PIN object