Refactor security ACL into module, remove checks for instance