refactored access control