Critical privacy fix for framework access control