[development] access control APIs