Add spec for controller access behavior