payment: access rights limitation

Still WIP