ACL to allow access to Product.category() method