Implement the access control check first. Access should only be given to asset if agent is authorized.