Extended ACL implementation based on controller annotations