Fix issue #5
Use origin (added refs) as the granularity of access control