[Bug 9238] access control documentation is confusing