API endpoint A2
AC-3: Access Enforcement