Add access check and explicitly use object ID.