diff --git a/automation/service/access_control.gen.go b/automation/service/access_control.gen.go
index 3df3cb3b3..c9c4b2b3d 100644
--- a/automation/service/access_control.gen.go
+++ b/automation/service/access_control.gen.go
@@ -420,10 +420,24 @@ func rbacResourceValidator(r string, oo ...string) error {
 //
 // This function is auto-generated
 func (svc accessControl) resourceLoader(ctx context.Context, resource string) (rbac.Resource, error) {
-	resourceType, ids := rbac.ParseResourceID(resource)
+	var (
+		hasWildcard       = false
+		resourceType, ids = rbac.ParseResourceID(resource)
+	)
+
+	for _, id := range ids {
+		if id == 0 {
+			hasWildcard = true
+			break
+		}
+	}
 
 	switch rbac.ResourceType(resourceType) {
 	case types.WorkflowResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.WorkflowRbacResource(0)), nil
+		}
+
 		return loadWorkflow(ctx, svc.store, ids[0])
 	case types.ComponentResourceType:
 		return &types.Component{}, nil
diff --git a/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl b/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
index c1c695539..d2cceadd1 100644
--- a/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
+++ b/codegen/assets/templates/gocode/rbac/$component_access_control.go.tpl
@@ -10,7 +10,6 @@ import (
 	"github.com/cortezaproject/corteza-server/store"
 	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
-	"github.com/cortezaproject/corteza-server/pkg/filter"
 	systemTypes "github.com/cortezaproject/corteza-server/system/types"
 	internalAuth "github.com/cortezaproject/corteza-server/pkg/auth"
 {{- range .imports }}
@@ -280,11 +279,25 @@ func rbacResourceValidator(r string, oo ...string) error {
 //
 // This function is auto-generated
 func (svc accessControl) resourceLoader(ctx context.Context, resource string) (rbac.Resource, error) {
-	resourceType, ids := rbac.ParseResourceID(resource)
+	var (
+		hasWildcard       = false
+		resourceType, ids = rbac.ParseResourceID(resource)
+	)
+
+	for _, id := range ids {
+		if id == 0 {
+			hasWildcard = true
+			break
+		}
+	}
 
 	switch rbac.ResourceType(resourceType) {
 	{{- range .loaders }}
 		case {{ .const }}:
+			if hasWildcard {
+				return rbac.NewResource({{ .resFunc }}({{ range $i := .refIndex }}0,{{ end }})), nil
+			}
+
 			return {{ .funcName }}(ctx, svc.store {{ range $i := .refIndex }}, ids[{{ $i }}]{{ end }})
 	{{- end }}
 	case types.ComponentResourceType:
diff --git a/codegen/server.rbac-access_control.cue b/codegen/server.rbac-access_control.cue
index ce44ce5fa..ef3b7d058 100644
--- a/codegen/server.rbac-access_control.cue
+++ b/codegen/server.rbac-access_control.cue
@@ -56,6 +56,7 @@ import (
 			loaders: [
 				for res in cmp.resources if res.rbac != _|_ {
 					const:    "types.\(res.expIdent)ResourceType"
+					resFunc:  "types.\(res.expIdent)RbacResource"
 					funcName: "load\(res.expIdent)"
 					refIndex: [ { 0 }, for i, p in res.parents {i + 1} ]
 				},
diff --git a/compose/service/access_control.gen.go b/compose/service/access_control.gen.go
index 38395a0c3..31426f4a5 100644
--- a/compose/service/access_control.gen.go
+++ b/compose/service/access_control.gen.go
@@ -9,8 +9,6 @@ package service
 import (
 	"context"
 	"fmt"
-	"strings"
-
 	"github.com/cortezaproject/corteza-server/compose/types"
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	internalAuth "github.com/cortezaproject/corteza-server/pkg/auth"
@@ -18,6 +16,7 @@ import (
 	"github.com/cortezaproject/corteza-server/store"
 	systemTypes "github.com/cortezaproject/corteza-server/system/types"
 	"github.com/spf13/cast"
+	"strings"
 )
 
 type (
@@ -688,20 +687,54 @@ func rbacResourceValidator(r string, oo ...string) error {
 //
 // This function is auto-generated
 func (svc accessControl) resourceLoader(ctx context.Context, resource string) (rbac.Resource, error) {
-	resourceType, ids := rbac.ParseResourceID(resource)
+	var (
+		hasWildcard       = false
+		resourceType, ids = rbac.ParseResourceID(resource)
+	)
+
+	for _, id := range ids {
+		if id == 0 {
+			hasWildcard = true
+			break
+		}
+	}
 
 	switch rbac.ResourceType(resourceType) {
 	case types.ChartResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ChartRbacResource(0, 0)), nil
+		}
+
 		return loadChart(ctx, svc.store, ids[0], ids[1])
 	case types.ModuleResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ModuleRbacResource(0, 0)), nil
+		}
+
 		return loadModule(ctx, svc.store, ids[0], ids[1])
 	case types.ModuleFieldResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ModuleFieldRbacResource(0, 0, 0)), nil
+		}
+
 		return loadModuleField(ctx, svc.store, ids[0], ids[1], ids[2])
 	case types.NamespaceResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.NamespaceRbacResource(0)), nil
+		}
+
 		return loadNamespace(ctx, svc.store, ids[0])
 	case types.PageResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.PageRbacResource(0, 0)), nil
+		}
+
 		return loadPage(ctx, svc.store, ids[0], ids[1])
 	case types.RecordResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.RecordRbacResource(0, 0, 0)), nil
+		}
+
 		return loadRecord(ctx, svc.store, ids[0], ids[1], ids[2])
 	case types.ComponentResourceType:
 		return &types.Component{}, nil
diff --git a/federation/service/access_control.gen.go b/federation/service/access_control.gen.go
index eddb2484f..d5d11c2da 100644
--- a/federation/service/access_control.gen.go
+++ b/federation/service/access_control.gen.go
@@ -390,14 +390,36 @@ func rbacResourceValidator(r string, oo ...string) error {
 //
 // This function is auto-generated
 func (svc accessControl) resourceLoader(ctx context.Context, resource string) (rbac.Resource, error) {
-	resourceType, ids := rbac.ParseResourceID(resource)
+	var (
+		hasWildcard       = false
+		resourceType, ids = rbac.ParseResourceID(resource)
+	)
+
+	for _, id := range ids {
+		if id == 0 {
+			hasWildcard = true
+			break
+		}
+	}
 
 	switch rbac.ResourceType(resourceType) {
 	case types.NodeResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.NodeRbacResource(0)), nil
+		}
+
 		return loadNode(ctx, svc.store, ids[0])
 	case types.ExposedModuleResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ExposedModuleRbacResource(0, 0)), nil
+		}
+
 		return loadExposedModule(ctx, svc.store, ids[0], ids[1])
 	case types.SharedModuleResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.SharedModuleRbacResource(0, 0)), nil
+		}
+
 		return loadSharedModule(ctx, svc.store, ids[0], ids[1])
 	case types.ComponentResourceType:
 		return &types.Component{}, nil
diff --git a/pkg/rbac/resource.go b/pkg/rbac/resource.go
index 1c5857ff6..cbe191d79 100644
--- a/pkg/rbac/resource.go
+++ b/pkg/rbac/resource.go
@@ -37,6 +37,11 @@ func (t resource) RbacResource() string {
 	return string(t)
 }
 
+// HasWildcards returns true if the given resource has wildcards
+func (t resource) HasWildcards() bool {
+	return hasWildcards(string(t))
+}
+
 // ResourceType extracts 1st part of the resource
 //
 // ns::cmp:res/c returns ns::cmp:res
diff --git a/system/service/access_control.gen.go b/system/service/access_control.gen.go
index f56aa9a15..071d5be88 100644
--- a/system/service/access_control.gen.go
+++ b/system/service/access_control.gen.go
@@ -1142,28 +1142,78 @@ func rbacResourceValidator(r string, oo ...string) error {
 //
 // This function is auto-generated
 func (svc accessControl) resourceLoader(ctx context.Context, resource string) (rbac.Resource, error) {
-	resourceType, ids := rbac.ParseResourceID(resource)
+	var (
+		hasWildcard       = false
+		resourceType, ids = rbac.ParseResourceID(resource)
+	)
+
+	for _, id := range ids {
+		if id == 0 {
+			hasWildcard = true
+			break
+		}
+	}
 
 	switch rbac.ResourceType(resourceType) {
 	case types.ApplicationResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ApplicationRbacResource(0)), nil
+		}
+
 		return loadApplication(ctx, svc.store, ids[0])
 	case types.ApigwRouteResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ApigwRouteRbacResource(0)), nil
+		}
+
 		return loadApigwRoute(ctx, svc.store, ids[0])
 	case types.AuthClientResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.AuthClientRbacResource(0)), nil
+		}
+
 		return loadAuthClient(ctx, svc.store, ids[0])
 	case types.DataPrivacyRequestResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.DataPrivacyRequestRbacResource(0)), nil
+		}
+
 		return loadDataPrivacyRequest(ctx, svc.store, ids[0])
 	case types.QueueResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.QueueRbacResource(0)), nil
+		}
+
 		return loadQueue(ctx, svc.store, ids[0])
 	case types.ReportResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.ReportRbacResource(0)), nil
+		}
+
 		return loadReport(ctx, svc.store, ids[0])
 	case types.RoleResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.RoleRbacResource(0)), nil
+		}
+
 		return loadRole(ctx, svc.store, ids[0])
 	case types.TemplateResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.TemplateRbacResource(0)), nil
+		}
+
 		return loadTemplate(ctx, svc.store, ids[0])
 	case types.UserResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.UserRbacResource(0)), nil
+		}
+
 		return loadUser(ctx, svc.store, ids[0])
 	case types.DalConnectionResourceType:
+		if hasWildcard {
+			return rbac.NewResource(types.DalConnectionRbacResource(0)), nil
+		}
+
 		return loadDalConnection(ctx, svc.store, ids[0])
 	case types.ComponentResourceType:
 		return &types.Component{}, nil