hosts and access control, and refinement