access control fixes and improvements