Restrict access to command and read model APIs