implement simple ACL check