add docs for access control