diff --git a/compose/module-field.cue b/compose/module-field.cue
index eb65e1db9..ef697f0c6 100644
--- a/compose/module-field.cue
+++ b/compose/module-field.cue
@@ -110,7 +110,12 @@ moduleField: schema.#Resource & {
 					description: """
 						searches for compose module field by name (case-insensitive)
 						"""
-				},
+				}, {
+					fields: ["id"]
+					description: """
+						searches for compose module field by ID
+						"""
+				}
 			]
 		}
 	}
diff --git a/compose/service/attachment.go b/compose/service/attachment.go
index deb663c8b..90f9dba5d 100644
--- a/compose/service/attachment.go
+++ b/compose/service/attachment.go
@@ -87,7 +87,7 @@ func (svc attachment) Find(ctx context.Context, filter types.AttachmentFilter) (
 		}
 
 		if filter.PageID > 0 {
-			aProps.namespace, aProps.page, err = loadPage(ctx, svc.store, filter.NamespaceID, filter.PageID)
+			aProps.namespace, aProps.page, err = loadPageCombo(ctx, svc.store, filter.NamespaceID, filter.PageID)
 			if err != nil {
 				return err
 			} else if svc.ac.CanReadPage(ctx, aProps.page) {
@@ -103,7 +103,7 @@ func (svc attachment) Find(ctx context.Context, filter types.AttachmentFilter) (
 				return AttachmentErrNotAllowedToReadRecord()
 			}
 		} else if filter.ModuleID > 0 {
-			aProps.namespace, aProps.module, err = loadModuleWithNamespace(ctx, svc.store, filter.NamespaceID, filter.ModuleID)
+			aProps.namespace, aProps.module, err = loadModuleCombo(ctx, svc.store, filter.NamespaceID, filter.ModuleID)
 			if err != nil {
 				return err
 			} else if svc.ac.CanReadRecord(ctx, aProps.record) {
@@ -263,7 +263,7 @@ func (svc attachment) CreatePageAttachment(ctx context.Context, namespaceID uint
 			return AttachmentErrNotAllowedToCreateEmptyAttachment()
 		}
 
-		ns, p, err = loadPage(ctx, s, namespaceID, pageID)
+		ns, p, err = loadPageCombo(ctx, s, namespaceID, pageID)
 		if err != nil {
 			return err
 		}
@@ -329,7 +329,7 @@ func (svc attachment) CreateRecordAttachment(ctx context.Context, namespaceID ui
 			return AttachmentErrNotAllowedToCreateEmptyAttachment()
 		}
 
-		ns, m, err = loadModuleWithNamespace(ctx, s, namespaceID, moduleID)
+		ns, m, err = loadModuleCombo(ctx, s, namespaceID, moduleID)
 		if err != nil {
 			return err
 		}
diff --git a/compose/service/chart.go b/compose/service/chart.go
index efa334d50..87eda3aa6 100644
--- a/compose/service/chart.go
+++ b/compose/service/chart.go
@@ -117,12 +117,7 @@ func (svc chart) Find(ctx context.Context, filter types.ChartFilter) (set types.
 
 func (svc chart) FindByID(ctx context.Context, namespaceID, chartID uint64) (c *types.Chart, err error) {
 	return svc.lookup(ctx, namespaceID, func(aProps *chartActionProps) (*types.Chart, error) {
-		if chartID == 0 {
-			return nil, ChartErrInvalidID()
-		}
-
-		aProps.chart.ID = chartID
-		return store.LookupComposeChartByID(ctx, svc.store, chartID)
+		return loadChart(ctx, svc.store, namespaceID, chartID)
 	})
 }
 
@@ -255,7 +250,7 @@ func (svc chart) updater(ctx context.Context, namespaceID, chartID uint64, actio
 	)
 
 	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
-		ns, c, err = loadChart(ctx, s, namespaceID, chartID)
+		ns, c, err = loadChartCombo(ctx, s, namespaceID, chartID)
 		if err != nil {
 			return
 		}
@@ -401,24 +396,31 @@ func (svc chart) handleUndelete(ctx context.Context, ns *types.Namespace, c *typ
 	return chartChanged, nil
 }
 
-func loadChart(ctx context.Context, s store.Storer, namespaceID, chartID uint64) (ns *types.Namespace, c *types.Chart, err error) {
-	if chartID == 0 {
-		return nil, nil, ChartErrInvalidID()
-	}
-
-	if ns, err = loadNamespace(ctx, s, namespaceID); err == nil {
-		if c, err = store.LookupComposeChartByID(ctx, s, chartID); errors.IsNotFound(err) {
-			err = ChartErrNotFound()
-		}
-	}
-
+func loadChartCombo(ctx context.Context, s interface {
+	store.ComposeCharts
+	store.ComposeNamespaces
+}, namespaceID, chartID uint64) (ns *types.Namespace, c *types.Chart, err error) {
+	ns, err = loadNamespace(ctx, s, namespaceID)
 	if err != nil {
-		return nil, nil, err
+		return
 	}
 
-	if namespaceID != c.NamespaceID {
+	c, err = loadChart(ctx, s, namespaceID, chartID)
+	return
+}
+
+func loadChart(ctx context.Context, s store.ComposeCharts, namespaceID, chartID uint64) (res *types.Chart, err error) {
+	if chartID == 0 || namespaceID == 0 {
+		return nil, ChartErrInvalidID()
+	}
+
+	if res, err = store.LookupComposeChartByID(ctx, s, chartID); errors.IsNotFound(err) {
+		err = ChartErrNotFound()
+	}
+
+	if err == nil && namespaceID != res.NamespaceID {
 		// Make sure chart belongs to the right namespace
-		return nil, nil, ChartErrNotFound()
+		return nil, ChartErrNotFound()
 	}
 
 	return
diff --git a/compose/service/locale.go b/compose/service/locale.go
index 40c5c74c3..7ac6466fb 100644
--- a/compose/service/locale.go
+++ b/compose/service/locale.go
@@ -359,20 +359,18 @@ func (svc resourceTranslationsManager) pageExtendedAutomationBlock(tag language.
 
 // Helper loaders
 
-func (svc resourceTranslationsManager) loadModule(ctx context.Context, s store.Storer, namespaceID, moduleID uint64) (m *types.Module, err error) {
-	return loadModule(ctx, s, moduleID)
+func (svc resourceTranslationsManager) loadModule(ctx context.Context, s store.Storer, namespaceID, moduleID uint64) (*types.Module, error) {
+	return loadModule(ctx, s, namespaceID, moduleID)
 }
 
-func (svc resourceTranslationsManager) loadNamespace(ctx context.Context, s store.Storer, namespaceID uint64) (m *types.Namespace, err error) {
+func (svc resourceTranslationsManager) loadNamespace(ctx context.Context, s store.Storer, namespaceID uint64) (*types.Namespace, error) {
 	return loadNamespace(ctx, s, namespaceID)
 }
 
-func (svc resourceTranslationsManager) loadPage(ctx context.Context, s store.Storer, namespaceID, pageID uint64) (m *types.Page, err error) {
-	_, m, err = loadPage(ctx, s, namespaceID, pageID)
-	return m, err
+func (svc resourceTranslationsManager) loadPage(ctx context.Context, s store.Storer, namespaceID, pageID uint64) (*types.Page, error) {
+	return loadPage(ctx, s, namespaceID, pageID)
 }
 
-func (svc resourceTranslationsManager) loadChart(ctx context.Context, s store.Storer, namespaceID, chartID uint64) (m *types.Chart, err error) {
-	_, m, err = loadChart(ctx, s, namespaceID, chartID)
-	return m, err
+func (svc resourceTranslationsManager) loadChart(ctx context.Context, s store.Storer, namespaceID, chartID uint64) (*types.Chart, error) {
+	return loadChart(ctx, s, namespaceID, chartID)
 }
diff --git a/compose/service/module.go b/compose/service/module.go
index 7c4cc5ee0..970c952e0 100644
--- a/compose/service/module.go
+++ b/compose/service/module.go
@@ -476,7 +476,7 @@ func (svc module) updater(ctx context.Context, namespaceID, moduleID uint64, act
 	)
 
 	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
-		ns, m, err = loadModuleWithNamespace(ctx, s, namespaceID, moduleID)
+		ns, m, err = loadModuleCombo(ctx, s, namespaceID, moduleID)
 		if err != nil {
 			return
 		}
@@ -955,42 +955,49 @@ func loadModuleFields(ctx context.Context, s store.Storer, mm ...*types.Module)
 }
 
 // loads record module with fields and namespace
-func loadModuleWithNamespace(ctx context.Context, s store.Storer, namespaceID, moduleID uint64) (ns *types.Namespace, m *types.Module, err error) {
-	if moduleID == 0 {
-		return nil, nil, ModuleErrInvalidID()
-	}
-
-	if ns, err = loadNamespace(ctx, s, namespaceID); err == nil {
-		m, err = loadModule(ctx, s, moduleID)
-	}
-
+func loadModuleCombo(ctx context.Context, s store.Storer, namespaceID, moduleID uint64) (ns *types.Namespace, m *types.Module, err error) {
+	ns, err = loadNamespace(ctx, s, namespaceID)
 	if err != nil {
-		return nil, nil, err
+		return
 	}
 
-	if namespaceID != m.NamespaceID {
+	m, err = loadModule(ctx, s, namespaceID, moduleID)
+	return
+}
+
+func loadModule(ctx context.Context, s store.Storer, namespaceID, moduleID uint64) (res *types.Module, err error) {
+	if moduleID == 0 {
+		return nil, ModuleErrInvalidID()
+	}
+
+	if res, err = store.LookupComposeModuleByID(ctx, s, moduleID); errors.IsNotFound(err) {
+		err = ModuleErrNotFound()
+	}
+
+	if err == nil && namespaceID != res.NamespaceID {
 		// Make sure chart belongs to the right namespace
-		return nil, nil, ModuleErrNotFound()
+		return nil, ModuleErrNotFound()
+	}
+
+	if err == nil {
+		err = loadModuleFields(ctx, s, res)
 	}
 
 	return
 }
 
-func loadModule(ctx context.Context, s store.Storer, moduleID uint64) (m *types.Module, err error) {
+func loadModuleField(ctx context.Context, s store.Storer, namespaceID, moduleID, fieldID uint64) (res *types.ModuleField, err error) {
 	if moduleID == 0 {
 		return nil, ModuleErrInvalidID()
 	}
 
-	if m, err = store.LookupComposeModuleByID(ctx, s, moduleID); errors.IsNotFound(err) {
+	if res, err = store.LookupComposeModuleFieldByID(ctx, s, fieldID); errors.IsNotFound(err) {
 		err = ModuleErrNotFound()
 	}
 
-	if err == nil {
-		err = loadModuleFields(ctx, s, m)
-	}
-
-	if err != nil {
-		return nil, err
+	if err == nil && (namespaceID != res.NamespaceID || moduleID != res.ModuleID) {
+		// Make sure chart belongs to the right namespace
+		return nil, ModuleErrNotFound()
 	}
 
 	return
diff --git a/compose/service/namespace.go b/compose/service/namespace.go
index 74852b8ce..73ee36895 100644
--- a/compose/service/namespace.go
+++ b/compose/service/namespace.go
@@ -766,7 +766,7 @@ func (svc namespace) envoyRun(ctx context.Context, resources resource.InterfaceS
 	return
 }
 
-func loadNamespace(ctx context.Context, s store.Storer, namespaceID uint64) (ns *types.Namespace, err error) {
+func loadNamespace(ctx context.Context, s store.ComposeNamespaces, namespaceID uint64) (ns *types.Namespace, err error) {
 	if namespaceID == 0 {
 		return nil, ChartErrInvalidNamespaceID()
 	}
diff --git a/compose/service/page.go b/compose/service/page.go
index 05c91d6cc..c2a05475f 100644
--- a/compose/service/page.go
+++ b/compose/service/page.go
@@ -335,7 +335,7 @@ func (svc page) Create(ctx context.Context, new *types.Page) (*types.Page, error
 
 func (svc page) Update(ctx context.Context, upd *types.Page) (c *types.Page, err error) {
 	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
-		ns, res, err := loadPage(ctx, s, upd.NamespaceID, upd.ID)
+		ns, res, err := loadPageCombo(ctx, s, upd.NamespaceID, upd.ID)
 		if err != nil {
 			return
 		}
@@ -362,7 +362,7 @@ func (svc page) DeleteByID(ctx context.Context, namespaceID, pageID uint64, stra
 	return store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
 		if strategy == types.PageChildrenOnDeleteForce {
 			// simply delete the page and ignore the subpages
-			ns, res, err = loadPage(ctx, s, namespaceID, pageID)
+			ns, res, err = loadPageCombo(ctx, s, namespaceID, pageID)
 			if err != nil {
 				return
 			}
@@ -430,7 +430,7 @@ func (svc page) DeleteByID(ctx context.Context, namespaceID, pageID uint64, stra
 
 func (svc page) UndeleteByID(ctx context.Context, namespaceID, pageID uint64) error {
 	return store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
-		ns, res, err := loadPage(ctx, s, namespaceID, pageID)
+		ns, res, err := loadPageCombo(ctx, s, namespaceID, pageID)
 		if err != nil {
 			return
 		}
@@ -719,28 +719,40 @@ func (svc *page) UpdateConfig(ss *systemTypes.AppSettings) {
 	}
 }
 
-func loadPage(ctx context.Context, s store.Storer, namespaceID, pageID uint64) (ns *types.Namespace, p *types.Page, err error) {
-	if pageID == 0 {
-		return nil, nil, PageErrInvalidID()
-	}
-
-	if ns, err = loadNamespace(ctx, s, namespaceID); err == nil {
-		if p, err = store.LookupComposePageByID(ctx, s, pageID); errors.IsNotFound(err) {
-			err = PageErrNotFound()
-		}
-	}
-
-	preparePageConfig(nil, p)
-
+func loadPageCombo(ctx context.Context, s interface {
+	store.ComposePages
+	store.ComposeNamespaces
+}, namespaceID, pageID uint64) (ns *types.Namespace, c *types.Page, err error) {
+	ns, err = loadNamespace(ctx, s, namespaceID)
 	if err != nil {
-		return nil, nil, err
+		return
 	}
 
-	if namespaceID != p.NamespaceID {
-		// Make sure chart belongs to the right namespace
-		return nil, nil, PageErrNotFound()
+	c, err = loadPage(ctx, s, namespaceID, pageID)
+	return
+}
+
+func loadPage(ctx context.Context, s store.ComposePages, namespaceID, pageID uint64) (res *types.Page, err error) {
+	if pageID == 0 || namespaceID == 0 {
+		return nil, PageErrInvalidID()
 	}
 
+	if res, err = store.LookupComposePageByID(ctx, s, pageID); errors.IsNotFound(err) {
+		err = PageErrNotFound()
+	}
+
+	if err == nil && namespaceID != res.NamespaceID {
+		// Make sure chart belongs to the right namespace
+		return nil, PageErrNotFound()
+	}
+
+	if err == nil && namespaceID != res.NamespaceID {
+		// Make sure page belongs to the right namespace
+		return nil, PageErrNotFound()
+	}
+
+	preparePageConfig(nil, res)
+
 	return
 }
 
diff --git a/compose/service/record.go b/compose/service/record.go
index b2f1e1a39..0be2dd159 100644
--- a/compose/service/record.go
+++ b/compose/service/record.go
@@ -220,7 +220,7 @@ func (svc record) lookup(ctx context.Context, namespaceID, moduleID uint64, look
 	)
 
 	err = func() error {
-		if ns, m, err = loadModuleWithNamespace(ctx, svc.store, namespaceID, moduleID); err != nil {
+		if ns, m, err = loadModuleCombo(ctx, svc.store, namespaceID, moduleID); err != nil {
 			return err
 		}
 
@@ -277,7 +277,7 @@ func (svc record) Find(ctx context.Context, filter types.RecordFilter) (set type
 	)
 
 	err = func() error {
-		if m, err = loadModule(ctx, svc.store, filter.ModuleID); err != nil {
+		if m, err = loadModule(ctx, svc.store, filter.NamespaceID, filter.ModuleID); err != nil {
 			return err
 		}
 
@@ -333,7 +333,7 @@ func (svc record) FindSensitive(ctx context.Context, filter types.RecordFilter)
 	)
 
 	err = func() error {
-		if m, err = loadModule(ctx, svc.store, filter.ModuleID); err != nil {
+		if m, err = loadModule(ctx, svc.store, filter.NamespaceID, filter.ModuleID); err != nil {
 			return err
 		}
 
@@ -518,7 +518,7 @@ func (svc record) create(ctx context.Context, new *types.Record) (rec *types.Rec
 		m  *types.Module
 	)
 
-	ns, m, err = loadModuleWithNamespace(ctx, svc.store, new.NamespaceID, new.ModuleID)
+	ns, m, err = loadModuleCombo(ctx, svc.store, new.NamespaceID, new.ModuleID)
 	if err != nil {
 		return
 	}
@@ -1087,7 +1087,7 @@ func (svc record) DeleteByID(ctx context.Context, namespaceID, moduleID uint64,
 			return RecordErrInvalidModuleID()
 		}
 
-		ns, m, err = loadModuleWithNamespace(ctx, svc.store, namespaceID, moduleID)
+		ns, m, err = loadModuleCombo(ctx, svc.store, namespaceID, moduleID)
 		if err != nil {
 			return err
 		}
@@ -1289,7 +1289,7 @@ func (svc record) Organize(ctx context.Context, namespaceID, moduleID, recordID
 }
 
 func (svc record) Validate(ctx context.Context, rec *types.Record) error {
-	if m, err := loadModule(ctx, svc.store, rec.ModuleID); err != nil {
+	if m, err := loadModule(ctx, svc.store, rec.NamespaceID, rec.ModuleID); err != nil {
 		return err
 	} else {
 		rec.Values = values.Sanitizer().Run(m, rec.Values)
@@ -1371,7 +1371,7 @@ func (svc record) Iterator(ctx context.Context, f types.RecordFilter, fn eventbu
 	)
 
 	err = func() error {
-		ns, m, err = loadModuleWithNamespace(ctx, svc.store, f.NamespaceID, f.ModuleID)
+		ns, m, err = loadModuleCombo(ctx, svc.store, f.NamespaceID, f.ModuleID)
 		if err != nil {
 			return err
 		}
@@ -1510,7 +1510,7 @@ func ComposeRecordFilterAC(ctx context.Context, ac recordValueAccessController,
 
 // loadRecordCombo Loads namespace, module and record
 func loadRecordCombo(ctx context.Context, s store.Storer, dal dalDater, namespaceID, moduleID, recordID uint64) (ns *types.Namespace, m *types.Module, r *types.Record, err error) {
-	if ns, m, err = loadModuleWithNamespace(ctx, s, namespaceID, moduleID); err != nil {
+	if ns, m, err = loadModuleCombo(ctx, s, namespaceID, moduleID); err != nil {
 		return
 	}
 
@@ -1525,6 +1525,16 @@ func loadRecordCombo(ctx context.Context, s store.Storer, dal dalDater, namespac
 	return
 }
 
+// loadRecord loads record
+//
+// function uses global DAL service to load records
+// this is because we need to be able to call it from AccessControl service
+// that does not have DAL
+func loadRecord(ctx context.Context, s store.Storer, namespaceID, moduleID, recordID uint64) (res *types.Record, err error) {
+	_, _, res, err = loadRecordCombo(ctx, s, dal.Service(), namespaceID, moduleID, recordID)
+	return
+}
+
 // toLabeledRecords converts to []label.LabeledResource
 //
 // This function is auto-generated.
diff --git a/federation/service/exposed_module.go b/federation/service/exposed_module.go
index 7b81ae7e9..c7ea91f06 100644
--- a/federation/service/exposed_module.go
+++ b/federation/service/exposed_module.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"strconv"
 
 	cs "github.com/cortezaproject/corteza-server/compose/service"
@@ -77,7 +78,7 @@ func (svc exposedModule) FindByAny(ctx context.Context, nodeID uint64, identifie
 
 func (svc exposedModule) FindByID(ctx context.Context, nodeID uint64, moduleID uint64) (module *types.ExposedModule, err error) {
 	err = func() error {
-		if module, err = store.LookupFederationExposedModuleByID(ctx, svc.store, moduleID); err != nil {
+		if module, err = loadExposedModule(ctx, svc.store, nodeID, moduleID); err != nil {
 			return err
 		}
 
@@ -157,7 +158,7 @@ func (svc exposedModule) updater(ctx context.Context, nodeID, moduleID uint64, a
 	)
 
 	err = store.Tx(ctx, svc.store, func(ctx context.Context, s store.Storer) (err error) {
-		if m, err = svc.store.LookupFederationExposedModuleByID(ctx, moduleID); err != nil {
+		if m, err = loadExposedModule(ctx, svc.store, nodeID, moduleID); err != nil {
 			return err
 		}
 
@@ -316,3 +317,20 @@ func (svc exposedModule) uniqueCheck(ctx context.Context, m *types.ExposedModule
 
 	return nil
 }
+
+func loadExposedModule(ctx context.Context, s store.FederationExposedModules, nodeID, ID uint64) (res *types.ExposedModule, err error) {
+	if ID == 0 || nodeID == 0 {
+		return nil, SharedModuleErrInvalidID()
+	}
+
+	if res, err = store.LookupFederationExposedModuleByID(ctx, s, ID); errors.IsNotFound(err) {
+		err = SharedModuleErrNotFound()
+	}
+
+	if err == nil && nodeID != res.NodeID {
+		// Make sure chart belongs to the right namespace
+		return nil, SharedModuleErrNotFound()
+	}
+
+	return
+}
diff --git a/federation/service/node.go b/federation/service/node.go
index 950392945..7b123c413 100644
--- a/federation/service/node.go
+++ b/federation/service/node.go
@@ -2,8 +2,8 @@ package service
 
 import (
 	"context"
-	"errors"
 	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -138,7 +138,7 @@ func (svc node) Create(ctx context.Context, new *types.Node) (*types.Node, error
 // Read is used mainly in UI, when retrieving details about the node
 func (svc node) Read(ctx context.Context, ID uint64) (*types.Node, error) {
 	var (
-		n, err = store.LookupFederationNodeByID(ctx, svc.store, ID)
+		n, err = loadNode(ctx, svc.store, ID)
 		aProps = &nodeActionProps{node: n}
 	)
 
@@ -417,10 +417,10 @@ func (svc node) updater(ctx context.Context, nodeID uint64, action func(...*node
 	)
 
 	err = func() error {
-		n, err = store.LookupFederationNodeByID(ctx, svc.store, nodeID)
+		n, err = loadNode(ctx, svc.store, nodeID)
 
-		if errors.Is(err, store.ErrNotFound) {
-			return NodeErrNotFound()
+		if err != nil {
+			return err
 		}
 
 		aProps.setNode(n)
@@ -461,14 +461,16 @@ func (svc node) FindBySharedNodeID(ctx context.Context, sharedNodeID uint64) (*t
 	return n, err
 }
 
-func (svc node) FindByID(ctx context.Context, nodeID uint64) (*types.Node, error) {
-	n, err := svc.store.LookupFederationNodeByID(ctx, nodeID)
+func (svc node) FindByID(ctx context.Context, nodeID uint64) (n *types.Node, err error) {
+	if n, err = loadNode(ctx, svc.store, nodeID); err != nil {
+		return
+	}
 
-	if n != nil && !svc.ac.CanManageNode(ctx, n) {
+	if !svc.ac.CanManageNode(ctx, n) {
 		return nil, NodeErrNotAllowedToManage()
 	}
 
-	return n, err
+	return
 }
 
 // Looks for existing user or crates a new one
@@ -578,3 +580,15 @@ func (svc node) makePairingURI(n *types.Node) string {
 
 	return uri.String()
 }
+
+func loadNode(ctx context.Context, s store.FederationNodes, ID uint64) (res *types.Node, err error) {
+	if ID == 0 {
+		return nil, NodeErrInvalidID()
+	}
+
+	if res, err = store.LookupFederationNodeByID(ctx, s, ID); errors.IsNotFound(err) {
+		err = NodeErrNotFound()
+	}
+
+	return
+}
diff --git a/federation/service/node_actions.gen.go b/federation/service/node_actions.gen.go
index aaa05e607..39d018321 100644
--- a/federation/service/node_actions.gen.go
+++ b/federation/service/node_actions.gen.go
@@ -534,6 +534,40 @@ func NodeErrNotFound(mm ...*nodeActionProps) *errors.Error {
 	return e
 }
 
+// NodeErrInvalidID returns "federation:node.invalidID" as *errors.Error
+//
+//
+// This function is auto-generated.
+//
+func NodeErrInvalidID(mm ...*nodeActionProps) *errors.Error {
+	var p = &nodeActionProps{}
+	if len(mm) > 0 {
+		p = mm[0]
+	}
+
+	var e = errors.New(
+		errors.KindInternal,
+
+		p.Format("invalid ID", nil),
+
+		errors.Meta("type", "invalidID"),
+		errors.Meta("resource", "federation:node"),
+
+		errors.Meta(nodePropsMetaKey{}, p),
+
+		// translation namespace & key
+		errors.Meta(locale.ErrorMetaNamespace{}, "federation"),
+		errors.Meta(locale.ErrorMetaKey{}, "node.errors.invalidID"),
+
+		errors.StackSkip(1),
+	)
+
+	if len(mm) > 0 {
+	}
+
+	return e
+}
+
 // NodeErrPairingURIInvalid returns "federation:node.pairingURIInvalid" as *errors.Error
 //
 //
diff --git a/federation/service/node_actions.yaml b/federation/service/node_actions.yaml
index 2b501a60a..434f003a0 100644
--- a/federation/service/node_actions.yaml
+++ b/federation/service/node_actions.yaml
@@ -41,7 +41,6 @@ actions:
   - action: update
     log: "updated {{node}}"
 
-
   - action: delete
     log: "deleted {{node}}"
 
@@ -68,6 +67,10 @@ errors:
     message: "node does not exist"
     severity: warning
 
+  - error: invalidID
+    message: "invalid ID"
+    severity: warning
+
   - error: pairingURIInvalid
     message: "pairing URI invalid: {{err}}"
 #
diff --git a/federation/service/shared_module.go b/federation/service/shared_module.go
index 08d1d0b9e..ebeff75ec 100644
--- a/federation/service/shared_module.go
+++ b/federation/service/shared_module.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 
 	composeService "github.com/cortezaproject/corteza-server/compose/service"
 	"github.com/cortezaproject/corteza-server/federation/types"
@@ -43,7 +44,7 @@ func SharedModule() *sharedModule {
 
 func (svc sharedModule) FindByID(ctx context.Context, nodeID uint64, moduleID uint64) (module *types.SharedModule, err error) {
 	err = func() error {
-		if module, err = store.LookupFederationSharedModuleByID(ctx, svc.store, moduleID); err != nil {
+		if module, err = loadSharedModule(ctx, svc.store, nodeID, moduleID); err != nil {
 			return err
 		}
 
@@ -151,3 +152,20 @@ func (svc sharedModule) Find(ctx context.Context, filter types.SharedModuleFilte
 
 	return set, f, svc.recordAction(ctx, aProps, SharedModuleActionSearch, err)
 }
+
+func loadSharedModule(ctx context.Context, s store.FederationSharedModules, nodeID, ID uint64) (res *types.SharedModule, err error) {
+	if ID == 0 || nodeID == 0 {
+		return nil, SharedModuleErrInvalidID()
+	}
+
+	if res, err = store.LookupFederationSharedModuleByID(ctx, s, ID); errors.IsNotFound(err) {
+		err = SharedModuleErrNotFound()
+	}
+
+	if err == nil && nodeID != res.NodeID {
+		// Make sure chart belongs to the right namespace
+		return nil, SharedModuleErrNotFound()
+	}
+
+	return
+}
diff --git a/store/adapters/rdbms/rdbms.gen.go b/store/adapters/rdbms/rdbms.gen.go
index 2488992d3..5d4ea4610 100644
--- a/store/adapters/rdbms/rdbms.gen.go
+++ b/store/adapters/rdbms/rdbms.gen.go
@@ -7393,6 +7393,46 @@ func (s *Store) LookupComposeModuleFieldByModuleIDName(ctx context.Context, modu
 	return aux.decode()
 }
 
+// LookupComposeModuleFieldByID searches for compose module field by ID
+//
+// This function is auto-generated
+func (s *Store) LookupComposeModuleFieldByID(ctx context.Context, id uint64) (_ *composeType.ModuleField, err error) {
+	var (
+		rows   *sql.Rows
+		aux    = new(auxComposeModuleField)
+		lookup = composeModuleFieldSelectQuery(s.Dialect).Where(
+			goqu.I("id").Eq(id),
+		).Limit(1)
+	)
+
+	rows, err = s.Query(ctx, lookup)
+	if err != nil {
+		return
+	}
+
+	defer func() {
+		closeError := rows.Close()
+		if err == nil {
+			// return error from close
+			err = closeError
+		}
+	}()
+
+	if err = rows.Err(); err != nil {
+		return
+	}
+
+	if !rows.Next() {
+		return nil, store.ErrNotFound.Stack(1)
+	}
+
+	if err = aux.scan(rows); err != nil {
+		return
+	}
+
+	return aux.decode()
+}
+
 // sortableComposeModuleFieldFields returns all <no value> columns flagged as sortable
 //
 // With optional string arg, all columns are returned aliased
diff --git a/store/interfaces.gen.go b/store/interfaces.gen.go
index 415c217b5..a070eeeec 100644
--- a/store/interfaces.gen.go
+++ b/store/interfaces.gen.go
@@ -279,6 +279,7 @@ type (
 		DeleteComposeModuleFieldByID(ctx context.Context, id uint64) error
 		TruncateComposeModuleFields(ctx context.Context) error
 		LookupComposeModuleFieldByModuleIDName(ctx context.Context, moduleID uint64, name string) (*composeType.ModuleField, error)
+		LookupComposeModuleFieldByID(ctx context.Context, id uint64) (*composeType.ModuleField, error)
 	}
 
 	ComposeNamespaces interface {
@@ -1638,6 +1639,13 @@ func LookupComposeModuleFieldByModuleIDName(ctx context.Context, s ComposeModule
 	return s.LookupComposeModuleFieldByModuleIDName(ctx, moduleID, name)
 }
 
+// LookupComposeModuleFieldByID searches for compose module field by ID
+//
+// This function is auto-generated
+func LookupComposeModuleFieldByID(ctx context.Context, s ComposeModuleFields, id uint64) (*composeType.ModuleField, error) {
+	return s.LookupComposeModuleFieldByID(ctx, id)
+}
+
 // SearchComposeNamespaces returns all matching ComposeNamespaces from store
 //
 // This function is auto-generated
diff --git a/system/dal_sensitivity_level.cue b/system/dal_sensitivity_level.cue
index dc166c888..0643bb4ed 100644
--- a/system/dal_sensitivity_level.cue
+++ b/system/dal_sensitivity_level.cue
@@ -30,9 +30,7 @@ dal_sensitivity_level: schema.#Resource & {
 		byNilState: ["deleted"]
 	}
 
-	rbac: {
-		operations: {}
-	}
+	rbac: false
 
 	features: {
 		labels: false
diff --git a/system/data_privacy_request_comment.cue b/system/data_privacy_request_comment.cue
index 3c5411beb..fe5da89b2 100644
--- a/system/data_privacy_request_comment.cue
+++ b/system/data_privacy_request_comment.cue
@@ -31,9 +31,7 @@ data_privacy_request_comment: schema.#Resource & {
 		byValue: ["request_id"]
 	}
 
-	rbac: {
-		operations: {}
-	}
+	rbac: false
 
 	store: {
 		api: {
diff --git a/system/queue_message.cue b/system/queue_message.cue
index 4366979b2..9cb31d86c 100644
--- a/system/queue_message.cue
+++ b/system/queue_message.cue
@@ -28,15 +28,7 @@ queue_message: schema.#Resource & {
 		byNilState: ["processed"]
 	}
 
-	rbac: {
-		operations: {
-			"read": description:        "Read queue"
-			"update": description:      "Update queue"
-			"delete": description:      "Delete queue"
-			"queue.read": description:  "Read from queue"
-			"queue.write": description: "Write to queue"
-		}
-	}
+	rbac: false
 
 	store: {
 		api: {
diff --git a/system/service/apigw_route.go b/system/service/apigw_route.go
index 552fced59..80b1f4914 100644
--- a/system/service/apigw_route.go
+++ b/system/service/apigw_route.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/apigw"
@@ -43,11 +44,7 @@ func (svc *apigwRoute) FindByID(ctx context.Context, ID uint64) (q *types.ApigwR
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return ApigwRouteErrInvalidID()
-		}
-
-		if q, err = store.LookupApigwRouteByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadApigwRoute(ctx, svc.store, ID); err != nil {
 			return ApigwRouteErrInvalidID().Wrap(err)
 		}
 
@@ -107,7 +104,7 @@ func (svc *apigwRoute) Update(ctx context.Context, upd *types.ApigwRoute) (q *ty
 	)
 
 	err = func() (err error) {
-		if qq, e = store.LookupApigwRouteByID(ctx, svc.store, upd.ID); e != nil {
+		if qq, e = loadApigwRoute(ctx, svc.store, upd.ID); e != nil {
 			return ApigwRouteErrNotFound(qProps)
 		}
 
@@ -150,11 +147,7 @@ func (svc *apigwRoute) DeleteByID(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ApigwRouteErrInvalidID()
-		}
-
-		if q, err = store.LookupApigwRouteByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadApigwRoute(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -191,11 +184,7 @@ func (svc *apigwRoute) UndeleteByID(ctx context.Context, ID uint64) (err error)
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ApigwRouteErrInvalidID()
-		}
-
-		if q, err = store.LookupApigwRouteByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadApigwRoute(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -253,3 +242,15 @@ func (svc *apigwRoute) Search(ctx context.Context, filter types.ApigwRouteFilter
 
 	return r, f, svc.recordAction(ctx, aProps, ApigwRouteActionSearch, err)
 }
+
+func loadApigwRoute(ctx context.Context, s store.ApigwRoutes, ID uint64) (res *types.ApigwRoute, err error) {
+	if ID == 0 {
+		return nil, ApigwRouteErrInvalidID()
+	}
+
+	if res, err = store.LookupApigwRouteByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, ApigwRouteErrNotFound()
+	}
+
+	return
+}
diff --git a/system/service/application.go b/system/service/application.go
index c43d016e7..311e01301 100644
--- a/system/service/application.go
+++ b/system/service/application.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	a "github.com/cortezaproject/corteza-server/pkg/auth"
@@ -43,11 +44,7 @@ func (svc *application) LookupByID(ctx context.Context, ID uint64) (app *types.A
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return ApplicationErrInvalidID()
-		}
-
-		if app, err = store.LookupApplicationByID(ctx, svc.store, ID); err != nil {
+		if app, err = loadApplication(ctx, svc.store, ID); err != nil {
 			return ApplicationErrInvalidID().Wrap(err)
 		}
 
@@ -194,11 +191,7 @@ func (svc *application) Update(ctx context.Context, upd *types.Application) (app
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return ApplicationErrInvalidID()
-		}
-
-		if app, err = store.LookupApplicationByID(ctx, svc.store, upd.ID); err != nil {
+		if app, err = loadApplication(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -247,11 +240,7 @@ func (svc *application) Delete(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ApplicationErrInvalidID()
-		}
-
-		if app, err = store.LookupApplicationByID(ctx, svc.store, ID); err != nil {
+		if app, err = loadApplication(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -284,11 +273,7 @@ func (svc *application) Undelete(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ApplicationErrInvalidID()
-		}
-
-		if app, err = store.LookupApplicationByID(ctx, svc.store, ID); err != nil {
+		if app, err = loadApplication(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -371,6 +356,18 @@ func (svc *application) Reorder(ctx context.Context, order []uint64) (err error)
 	return svc.recordAction(ctx, aProps, ApplicationActionReorder, err)
 }
 
+func loadApplication(ctx context.Context, s store.Applications, ID uint64) (res *types.Application, err error) {
+	if ID == 0 {
+		return nil, ApplicationErrInvalidID()
+	}
+
+	if res, err = store.LookupApplicationByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, ApplicationErrNotFound()
+	}
+
+	return
+}
+
 // toLabeledApplications converts to []label.LabeledResource
 //
 // This function is auto-generated.
diff --git a/system/service/auth_client.go b/system/service/auth_client.go
index db41fb732..c0282917c 100644
--- a/system/service/auth_client.go
+++ b/system/service/auth_client.go
@@ -98,11 +98,7 @@ func (svc *authClient) IsDefaultClient(c *types.AuthClient) bool {
 
 func (svc *authClient) lookupByID(ctx context.Context, ID uint64) (client *types.AuthClient, err error) {
 	err = func() error {
-		if ID == 0 {
-			return AuthClientErrInvalidID()
-		}
-
-		if client, err = store.LookupAuthClientByID(ctx, svc.store, ID); err != nil {
+		if client, err = loadAuthClient(ctx, svc.store, ID); err != nil {
 			return AuthClientErrInvalidID().Wrap(err)
 		}
 
@@ -185,7 +181,7 @@ func (svc *authClient) Search(ctx context.Context, af types.AuthClientFilter) (a
 	return aa, f, svc.recordAction(ctx, aaProps, AuthClientActionSearch, err)
 }
 
-func (svc *authClient) Create(ctx context.Context, new *types.AuthClient) (app *types.AuthClient, err error) {
+func (svc *authClient) Create(ctx context.Context, new *types.AuthClient) (res *types.AuthClient, err error) {
 	var (
 		aaProps = &authClientActionProps{new: new}
 	)
@@ -227,13 +223,13 @@ func (svc *authClient) Create(ctx context.Context, new *types.AuthClient) (app *
 			return
 		}
 
-		app = new
+		res = new
 
 		_ = svc.eventbus.WaitFor(ctx, event.AuthClientAfterCreate(new, nil))
 		return nil
 	}()
 
-	return app, svc.recordAction(ctx, aaProps, AuthClientActionCreate, err)
+	return res, svc.recordAction(ctx, aaProps, AuthClientActionCreate, err)
 }
 
 func (svc *authClient) Update(ctx context.Context, upd *types.AuthClient) (res *types.AuthClient, err error) {
@@ -263,7 +259,7 @@ func (svc *authClient) Update(ctx context.Context, upd *types.AuthClient) (res *
 			return AuthClientErrInvalidID()
 		}
 
-		if res, err = store.LookupAuthClientByID(ctx, svc.store, upd.ID); err != nil {
+		if res, err = loadAuthClient(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -334,38 +330,34 @@ func (svc *authClient) Update(ctx context.Context, upd *types.AuthClient) (res *
 func (svc *authClient) Delete(ctx context.Context, ID uint64) (err error) {
 	var (
 		aaProps = &authClientActionProps{}
-		app     *types.AuthClient
+		res     *types.AuthClient
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return AuthClientErrInvalidID()
-		}
-
-		if app, err = store.LookupAuthClientByID(ctx, svc.store, ID); err != nil {
+		if res, err = loadAuthClient(ctx, svc.store, ID); err != nil {
 			return
 		}
 
-		aaProps.setAuthClient(app)
+		aaProps.setAuthClient(res)
 
-		if !svc.ac.CanDeleteAuthClient(ctx, app) {
+		if !svc.ac.CanDeleteAuthClient(ctx, res) {
 			return AuthClientErrNotAllowedToDelete()
 		}
 
-		if app.Handle == svc.opt.DefaultClient {
+		if res.Handle == svc.opt.DefaultClient {
 			return AuthClientErrUnableToDeleteDefaultClient()
 		}
 
-		if err = svc.eventbus.WaitFor(ctx, event.AuthClientBeforeDelete(nil, app)); err != nil {
+		if err = svc.eventbus.WaitFor(ctx, event.AuthClientBeforeDelete(nil, res)); err != nil {
 			return
 		}
 
-		app.DeletedAt = now()
-		if err = store.UpdateAuthClient(ctx, svc.store, app); err != nil {
+		res.DeletedAt = now()
+		if err = store.UpdateAuthClient(ctx, svc.store, res); err != nil {
 			return
 		}
 
-		_ = svc.eventbus.WaitFor(ctx, event.AuthClientAfterDelete(nil, app))
+		_ = svc.eventbus.WaitFor(ctx, event.AuthClientAfterDelete(nil, res))
 		return nil
 	}()
 
@@ -375,42 +367,50 @@ func (svc *authClient) Delete(ctx context.Context, ID uint64) (err error) {
 func (svc *authClient) Undelete(ctx context.Context, ID uint64) (err error) {
 	var (
 		aaProps = &authClientActionProps{}
-		app     *types.AuthClient
+		res     *types.AuthClient
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return AuthClientErrInvalidID()
-		}
-
-		if app, err = store.LookupAuthClientByID(ctx, svc.store, ID); err != nil {
+		if res, err = loadAuthClient(ctx, svc.store, ID); err != nil {
 			return
 		}
 
-		aaProps.setAuthClient(app)
+		aaProps.setAuthClient(res)
 
-		if !svc.ac.CanDeleteAuthClient(ctx, app) {
+		if !svc.ac.CanDeleteAuthClient(ctx, res) {
 			return AuthClientErrNotAllowedToUndelete()
 		}
 
 		// @todo add event
-		//       if err = svc.eventbus.WaitFor(ctx, event.AuthClientBeforeUndelete(nil, app)); err != nil {
+		//       if err = svc.eventbus.WaitFor(ctx, event.AuthClientBeforeUndelete(nil, res)); err != nil {
 		//       	return
 		//       }
 
-		app.DeletedAt = nil
-		if err = store.UpdateAuthClient(ctx, svc.store, app); err != nil {
+		res.DeletedAt = nil
+		if err = store.UpdateAuthClient(ctx, svc.store, res); err != nil {
 			return
 		}
 
 		// @todo add event
-		//       _ = svc.eventbus.WaitFor(ctx, event.AuthClientAfterUndelete(nil, app))
+		//       _ = svc.eventbus.WaitFor(ctx, event.AuthClientAfterUndelete(nil, res))
 		return nil
 	}()
 
 	return svc.recordAction(ctx, aaProps, AuthClientActionUndelete, err)
 }
 
+func loadAuthClient(ctx context.Context, s store.AuthClients, ID uint64) (res *types.AuthClient, err error) {
+	if ID == 0 {
+		return nil, AuthClientErrInvalidID()
+	}
+
+	if res, err = store.LookupAuthClientByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, AuthClientErrNotFound()
+	}
+
+	return
+}
+
 // toLabeledAuthClients converts to []label.LabeledResource
 //
 // This function is auto-generated.
diff --git a/system/service/dal_connection.go b/system/service/dal_connection.go
index aca8c9cf7..086918d4a 100644
--- a/system/service/dal_connection.go
+++ b/system/service/dal_connection.go
@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"reflect"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
@@ -57,11 +58,7 @@ func (svc *dalConnection) FindByID(ctx context.Context, ID uint64) (q *types.Dal
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return DalConnectionErrInvalidID()
-		}
-
-		if q, err = store.LookupDalConnectionByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadDalConnection(ctx, svc.store, ID); err != nil {
 			return DalConnectionErrInvalidID().Wrap(err)
 		}
 
@@ -123,7 +120,7 @@ func (svc *dalConnection) Update(ctx context.Context, upd *types.DalConnection)
 	)
 
 	err = func() (err error) {
-		if old, err = store.LookupDalConnectionByID(ctx, svc.store, upd.ID); err != nil {
+		if old, err = loadDalConnection(ctx, svc.store, upd.ID); err != nil {
 			return DalConnectionErrNotFound(cProps)
 		}
 
@@ -169,11 +166,7 @@ func (svc *dalConnection) DeleteByID(ctx context.Context, ID uint64) (err error)
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return DalConnectionErrInvalidID()
-		}
-
-		if c, err = store.LookupDalConnectionByID(ctx, svc.store, ID); err != nil {
+		if c, err = loadDalConnection(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -207,11 +200,7 @@ func (svc *dalConnection) UndeleteByID(ctx context.Context, ID uint64) (err erro
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return DalConnectionErrInvalidID()
-		}
-
-		if c, err = store.LookupDalConnectionByID(ctx, svc.store, ID); err != nil {
+		if c, err = loadDalConnection(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -301,6 +290,18 @@ func (svc *dalConnection) procLocale(c *types.DalConnection) {
 	// @todo...
 }
 
+func loadDalConnection(ctx context.Context, s store.DalConnections, ID uint64) (res *types.DalConnection, err error) {
+	if ID == 0 {
+		return nil, DalConnectionErrInvalidID()
+	}
+
+	if res, err = store.LookupDalConnectionByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, DalConnectionErrNotFound()
+	}
+
+	return
+}
+
 func dalConnectionReload(ctx context.Context, s store.Storer, dcm dalConnManager) (err error) {
 	// Get all available connections
 	cc, _, err := store.SearchDalConnections(ctx, s, types.DalConnectionFilter{})
diff --git a/system/service/data_privacy.go b/system/service/data_privacy.go
index 3c24d9109..9f14997b0 100644
--- a/system/service/data_privacy.go
+++ b/system/service/data_privacy.go
@@ -53,11 +53,7 @@ func (svc dataPrivacy) FindRequestByID(ctx context.Context, requestID uint64) (r
 	)
 
 	err = func() error {
-		if requestID == 0 {
-			return DataPrivacyErrInvalidID()
-		}
-
-		r, err = store.LookupDataPrivacyRequestByID(ctx, svc.store, requestID)
+		r, err = loadDataPrivacyRequest(ctx, svc.store, requestID)
 		if r, err = svc.procRequest(ctx, r, err); err != nil {
 			return err
 		}
@@ -158,10 +154,6 @@ func (svc dataPrivacy) UpdateRequestStatus(ctx context.Context, upd *types.DataP
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return DataPrivacyErrInvalidID()
-		}
-
 		if len(upd.Status.String()) == 0 {
 			return DataPrivacyErrInvalidStatus()
 		}
@@ -176,7 +168,7 @@ func (svc dataPrivacy) UpdateRequestStatus(ctx context.Context, upd *types.DataP
 			}
 		}
 
-		if r, err = store.LookupDataPrivacyRequestByID(ctx, svc.store, upd.ID); err != nil {
+		if r, err = loadDataPrivacyRequest(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -239,3 +231,15 @@ func (svc dataPrivacy) CreateRequestComment(ctx context.Context, new *types.Data
 
 	return r, err
 }
+
+func loadDataPrivacyRequest(ctx context.Context, s store.DataPrivacyRequests, ID uint64) (res *types.DataPrivacyRequest, err error) {
+	if ID == 0 {
+		return nil, DataPrivacyErrInvalidID()
+	}
+
+	if res, err = store.LookupDataPrivacyRequestByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, DataPrivacyErrNotFound()
+	}
+
+	return
+}
diff --git a/system/service/queue.go b/system/service/queue.go
index eba22dc61..6629236c4 100644
--- a/system/service/queue.go
+++ b/system/service/queue.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
 	"github.com/cortezaproject/corteza-server/pkg/eventbus"
@@ -100,11 +101,7 @@ func (svc *queue) FindByID(ctx context.Context, ID uint64) (q *types.Queue, err
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return QueueErrInvalidID()
-		}
-
-		if q, err = store.LookupQueueByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadQueue(ctx, svc.store, ID); err != nil {
 			return TemplateErrInvalidID().Wrap(err)
 		}
 
@@ -203,11 +200,7 @@ func (svc *queue) DeleteByID(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return QueueErrInvalidID()
-		}
-
-		if q, err = store.LookupQueueByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadQueue(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -238,11 +231,7 @@ func (svc *queue) UndeleteByID(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return QueueErrInvalidID()
-		}
-
-		if q, err = store.LookupQueueByID(ctx, svc.store, ID); err != nil {
+		if q, err = loadQueue(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -295,6 +284,18 @@ func (svc *queue) Search(ctx context.Context, filter types.QueueFilter) (q types
 	return q, f, svc.recordAction(ctx, aProps, QueueActionSearch, err)
 }
 
+func loadQueue(ctx context.Context, s store.Queues, ID uint64) (res *types.Queue, err error) {
+	if ID == 0 {
+		return nil, QueueErrInvalidID()
+	}
+
+	if res, err = store.LookupQueueByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, QueueErrNotFound()
+	}
+
+	return
+}
+
 func (svc *queue) isValidHandler(h mt.ConsumerType) bool {
 	for _, hh := range mt.ConsumerTypes() {
 		if h == hh {
diff --git a/system/service/report.go b/system/service/report.go
index 7d74665c7..6f5214912 100644
--- a/system/service/report.go
+++ b/system/service/report.go
@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"strconv"
 
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
@@ -62,11 +63,7 @@ func (svc *report) LookupByID(ctx context.Context, ID uint64) (report *types.Rep
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return ReportErrInvalidID()
-		}
-
-		if report, err = store.LookupReportByID(ctx, svc.store, ID); err != nil {
+		if report, err = loadReport(ctx, svc.store, ID); err != nil {
 			return ReportErrInvalidID().Wrap(err)
 		}
 
@@ -179,11 +176,7 @@ func (svc *report) Update(ctx context.Context, upd *types.Report) (report *types
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return ReportErrInvalidID()
-		}
-
-		if report, err = store.LookupReportByID(ctx, svc.store, upd.ID); err != nil {
+		if report, err = loadReport(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -236,11 +229,7 @@ func (svc *report) Delete(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ReportErrInvalidID()
-		}
-
-		if report, err = store.LookupReportByID(ctx, svc.store, ID); err != nil {
+		if report, err = loadReport(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -273,11 +262,7 @@ func (svc *report) Undelete(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return ReportErrInvalidID()
-		}
-
-		if report, err = store.LookupReportByID(ctx, svc.store, ID); err != nil {
+		if report, err = loadReport(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -358,11 +343,7 @@ func (svc *report) Run(ctx context.Context, reportID uint64, dd rep.FrameDefinit
 		// 	return
 		// }
 
-		if reportID == 0 {
-			return ReportErrInvalidID()
-		}
-
-		r, err := store.LookupReportByID(ctx, svc.store, reportID)
+		r, err := loadReport(ctx, svc.store, reportID)
 		if err != nil {
 			return err
 		}
@@ -554,6 +535,18 @@ func (svc *report) setIDs(r *types.Report) *types.Report {
 	return r
 }
 
+func loadReport(ctx context.Context, s store.Reports, ID uint64) (res *types.Report, err error) {
+	if ID == 0 {
+		return nil, ReportErrInvalidID()
+	}
+
+	if res, err = store.LookupReportByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, ReportErrNotFound()
+	}
+
+	return
+}
+
 // toLabeledReports converts to []label.LabeledResource
 //
 // This function is auto-generated.
diff --git a/system/service/role.go b/system/service/role.go
index b438fae0a..44053c15a 100644
--- a/system/service/role.go
+++ b/system/service/role.go
@@ -220,11 +220,7 @@ func (svc role) FindByID(ctx context.Context, roleID uint64) (r *types.Role, err
 }
 
 func (svc role) findByID(ctx context.Context, roleID uint64) (*types.Role, error) {
-	if roleID == 0 {
-		return nil, RoleErrInvalidID()
-	}
-
-	r, err := store.LookupRoleByID(ctx, svc.store, roleID)
+	r, err := loadRole(ctx, svc.store, roleID)
 	return svc.proc(ctx, r, err)
 }
 
@@ -356,10 +352,6 @@ func (svc role) Update(ctx context.Context, upd *types.Role) (r *types.Role, err
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return RoleErrInvalidID()
-		}
-
 		if !handle.IsValid(upd.Handle) {
 			return RoleErrInvalidHandle()
 		}
@@ -368,7 +360,7 @@ func (svc role) Update(ctx context.Context, upd *types.Role) (r *types.Role, err
 			return RoleErrNotAllowedToUpdate()
 		}
 
-		if r, err = store.LookupRoleByID(ctx, svc.store, upd.ID); err != nil {
+		if r, err = loadRole(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -772,6 +764,18 @@ func (svc role) MemberRemove(ctx context.Context, roleID, memberID uint64) (err
 	return svc.recordAction(ctx, raProps, RoleActionMemberRemove, err)
 }
 
+func loadRole(ctx context.Context, s store.Roles, ID uint64) (res *types.Role, err error) {
+	if ID == 0 {
+		return nil, RoleErrInvalidID()
+	}
+
+	if res, err = store.LookupRoleByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, RoleErrNotFound()
+	}
+
+	return
+}
+
 // toLabeledRoles converts to []label.LabeledResource
 //
 // This function is auto-generated.
diff --git a/system/service/template.go b/system/service/template.go
index 169d6dc81..2a4f5c01e 100644
--- a/system/service/template.go
+++ b/system/service/template.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"github.com/cortezaproject/corteza-server/pkg/errors"
 	"io"
 	"strconv"
 	"strings"
@@ -73,11 +74,7 @@ func (svc template) FindByID(ctx context.Context, ID uint64) (tpl *types.Templat
 	)
 
 	err = func() error {
-		if ID == 0 {
-			return TemplateErrInvalidID()
-		}
-
-		if tpl, err = store.LookupTemplateByID(ctx, svc.store, ID); err != nil {
+		if tpl, err = loadTemplate(ctx, svc.store, ID); err != nil {
 			return TemplateErrInvalidID().Wrap(err)
 		}
 
@@ -232,15 +229,11 @@ func (svc template) Update(ctx context.Context, upd *types.Template) (tpl *types
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return TemplateErrInvalidID()
-		}
-
 		if !handle.IsValid(upd.Handle) {
 			return TemplateErrInvalidHandle()
 		}
 
-		if tpl, err = store.LookupTemplateByID(ctx, svc.store, upd.ID); err != nil {
+		if tpl, err = loadTemplate(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -285,11 +278,7 @@ func (svc template) DeleteByID(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return TemplateErrInvalidID()
-		}
-
-		if tpl, err = store.LookupTemplateByID(ctx, svc.store, ID); err != nil {
+		if tpl, err = loadTemplate(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -319,11 +308,7 @@ func (svc template) UndeleteByID(ctx context.Context, ID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if ID == 0 {
-			return TemplateErrInvalidID()
-		}
-
-		if tpl, err = store.LookupTemplateByID(ctx, svc.store, ID); err != nil {
+		if tpl, err = loadTemplate(ctx, svc.store, ID); err != nil {
 			return
 		}
 
@@ -482,6 +467,18 @@ func (svc template) getAttachments(ctx context.Context, tpl *types.Template) (re
 	// })
 }
 
+func loadTemplate(ctx context.Context, s store.Templates, ID uint64) (res *types.Template, err error) {
+	if ID == 0 {
+		return nil, TemplateErrInvalidID()
+	}
+
+	if res, err = store.LookupTemplateByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, TemplateErrNotFound()
+	}
+
+	return
+}
+
 // toLabeledTemplates converts to []label.LabeledResource
 func toLabeledTemplates(set []*types.Template) []label.LabeledResource {
 	if len(set) == 0 {
diff --git a/system/service/user.go b/system/service/user.go
index 0a05106fc..6ddd235db 100644
--- a/system/service/user.go
+++ b/system/service/user.go
@@ -118,11 +118,7 @@ func (svc user) FindByID(ctx context.Context, userID uint64) (u *types.User, err
 	)
 
 	err = func() error {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-
-		u, err = store.LookupUserByID(ctx, svc.store, userID)
+		u, err = loadUser(ctx, svc.store, userID)
 		if u, err = svc.proc(ctx, u, err); err != nil {
 			return err
 		}
@@ -399,10 +395,6 @@ func (svc user) Update(ctx context.Context, upd *types.User) (u *types.User, err
 	)
 
 	err = func() (err error) {
-		if upd.ID == 0 {
-			return UserErrInvalidID()
-		}
-
 		if !handle.IsValid(upd.Handle) {
 			return UserErrInvalidHandle()
 		}
@@ -411,7 +403,7 @@ func (svc user) Update(ctx context.Context, upd *types.User) (u *types.User, err
 			return UserErrInvalidEmail()
 		}
 
-		if u, err = store.LookupUserByID(ctx, svc.store, upd.ID); err != nil {
+		if u, err = loadUser(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -474,10 +466,7 @@ func (svc user) ToggleEmailConfirmation(ctx context.Context, userID uint64, conf
 	)
 
 	err = func() (err error) {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -512,11 +501,7 @@ func (svc user) Delete(ctx context.Context, userID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -555,11 +540,7 @@ func (svc user) Undelete(ctx context.Context, userID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -600,11 +581,7 @@ func (svc user) Suspend(ctx context.Context, userID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -649,11 +626,7 @@ func (svc user) Unsuspend(ctx context.Context, userID uint64) (err error) {
 	)
 
 	err = func() (err error) {
-		if userID == 0 {
-			return UserErrInvalidID()
-		}
-
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return
 		}
 
@@ -693,7 +666,7 @@ func (svc user) SetPassword(ctx context.Context, userID uint64, newPassword stri
 	)
 
 	err = func() (err error) {
-		if u, err = store.LookupUserByID(ctx, svc.store, userID); err != nil {
+		if u, err = loadUser(ctx, svc.store, userID); err != nil {
 			return err
 		}
 
@@ -830,6 +803,18 @@ func (svc user) checkLimits(ctx context.Context) error {
 	return nil
 }
 
+func loadUser(ctx context.Context, s store.Users, ID uint64) (res *types.User, err error) {
+	if ID == 0 {
+		return nil, UserErrInvalidID()
+	}
+
+	if res, err = store.LookupUserByID(ctx, s, ID); errors.IsNotFound(err) {
+		return nil, UserErrNotFound()
+	}
+
+	return
+}
+
 func countValidUsers(ctx context.Context, s store.Users) (c uint, err error) {
 	return store.CountUsers(ctx, s, types.UserFilter{Kind: types.NormalUser})
 }