repo access control with inheritance