RE: [development] access control APIs