diff --git a/provision/000_base/compose_access_control.yaml b/provision/000_base/compose_access_control.yaml
index 9ff4588d4..ce3960e2f 100644
--- a/provision/000_base/compose_access_control.yaml
+++ b/provision/000_base/compose_access_control.yaml
@@ -5,9 +5,13 @@ allow:
 
     corteza::compose:namespace/*:
       - read
+      - pages.search
+      - modules.search
+      - charts.search
 
     corteza::compose:module/*/*:
       - read
+      - records.search
 
     corteza::compose:page/*/*:
       - read
@@ -26,7 +30,7 @@ allow:
       - namespace.create
       - namespaces.search
 
-    corteza::compose:namespace/*/*:
+    corteza::compose:namespace/*:
       - read
       - update
       - delete
@@ -72,7 +76,7 @@ allow:
       - namespace.create
       - namespaces.search
 
-    corteza::compose:namespace/*/*:
+    corteza::compose:namespace/*:
       - read
       - update
       - delete
diff --git a/provision/000_base/system_access_control.yaml b/provision/000_base/system_access_control.yaml
index ac04fc931..cca5cdde8 100644
--- a/provision/000_base/system_access_control.yaml
+++ b/provision/000_base/system_access_control.yaml
@@ -7,20 +7,18 @@ allow:
 
     corteza::system:application/*:
       - read
+      - application.flag.self
 
     corteza::system:role/*:
       - read
 
-    corteza::system:template/*:
-      - read
-      - render
-
-    corteza::system:queue/*:
-      - queue.read
+    corteza::system:auth-client/*:
+      - authorize
 
   admins:
     corteza::system/:
       - grant
+      - action-log.read
       - settings.read
       - settings.manage
       - application.create
@@ -36,6 +34,13 @@ allow:
       - reminder.assign
       - queue.create
       - queues.search
+      - application.flag.global
+
+    corteza::system:auth-client/*:
+      - read
+      - update
+      - delete
+      - authorize
 
     corteza::system:application/*:
       - read
@@ -73,6 +78,7 @@ allow:
   security_admins:
     corteza::compose/:
       - grant
+      - action-log.read
       - settings.read
       - settings.manage
 
@@ -104,6 +110,12 @@ allow:
       - queue.create
       - queues.search
 
+    corteza::system:auth-client/*:
+      - read
+      - update
+      - delete
+      - authorize
+
     corteza::system:application/*:
       - read
       - update
diff --git a/provision/003_auth/auth_client_access_control.yaml b/provision/003_auth/auth_client_access_control.yaml
deleted file mode 100644
index 598171933..000000000
--- a/provision/003_auth/auth_client_access_control.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-allow:
-  authenticated:
-    corteza::system:auth-client/*:
-      - authorize
-
-  admins:
-    corteza::system:auth-client/*:
-      - read
-      - update
-      - delete
diff --git a/provision/300_automation/2000_access_control.yaml b/provision/300_automation/2000_access_control.yaml
index ebd0b0731..f2d70c019 100644
--- a/provision/300_automation/2000_access_control.yaml
+++ b/provision/300_automation/2000_access_control.yaml
@@ -32,5 +32,3 @@ allow:
       - execute
       - triggers.manage
       - sessions.manage
-
-