restrict some entity APIs on the server