access control process