stricter layering. view only access controllers