backend access checking added