diff --git a/common/models/category.json b/common/models/category.json
index b5f0f9bfbeba107a089e15984b362f05d5a1151b..e01860e370803c0738b5fead7908ca2b23fdd6d4 100644
--- a/common/models/category.json
+++ b/common/models/category.json
@@ -16,17 +16,42 @@
   },
   "validations": [],
   "relations": {
-    "locations":{
+    "locations": {
       "type": "hasMany",
       "model": "geolocation",
       "foreignKey": "category_id"
     },
-    "user":{
+    "user": {
       "type": "belongsTo",
       "model": "end_user",
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "count",
+      "principalType": "ROLE",
+      "principalId": "$authenticated",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }
diff --git a/common/models/end_user.json b/common/models/end_user.json
index 9a1559fceec3c795fed474461c21e3d3c983ff36..b936c03a4f4c2c1cf1a172b2c9f06edb52fdf040 100644
--- a/common/models/end_user.json
+++ b/common/models/end_user.json
@@ -25,17 +25,42 @@
   },
   "validations": [],
   "relations": {
-    "locations":{
+    "locations": {
       "type": "hasMany",
       "model": "geolocation",
       "foreignKey": "user_id"
     },
-    "category":{
+    "category": {
       "type": "hasMany",
       "model": "categories",
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$owner",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "EXECUTE",
+      "principalType": "ROLE",
+      "principalId": "$owner",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }
diff --git a/common/models/geolocation.json b/common/models/geolocation.json
index 4e24cc6e97bed5c1b0da71a9d92d6cb3f5631551..e063519bcd3d4c1f647c405efca7ca7142436fb0 100644
--- a/common/models/geolocation.json
+++ b/common/models/geolocation.json
@@ -17,17 +17,17 @@
     },
     "latitude": {
       "type": "number",
-      "postgresql":{
-        "dataType":"float"
-      },
-      "required": true
+      "required": true,
+      "postgresql": {
+        "dataType": "float"
+      }
     },
     "longitude": {
       "type": "number",
-      "postgresql":{
-        "dataType":"float"
-      },
-      "required": true
+      "required": true,
+      "postgresql": {
+        "dataType": "float"
+      }
     },
     "android_id": {
       "type": "string"
@@ -45,17 +45,42 @@
   },
   "validations": [],
   "relations": {
-    "user":{
+    "user": {
       "type": "belongsTo",
       "model": "end_user",
       "foreignKey": "id"
     },
-    "category":{
+    "category": {
       "type": "belongsTo",
       "model": "category",
       "foreignKey": "id"
     }
   },
-  "acls": [],
+  "acls": [
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "DENY"
+    },
+    {
+      "accessType": "WRITE",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "READ",
+      "principalType": "ROLE",
+      "principalId": "$everyone",
+      "permission": "ALLOW"
+    },
+    {
+      "accessType": "*",
+      "principalType": "ROLE",
+      "principalId": "admin",
+      "permission": "ALLOW"
+    }
+  ],
   "methods": {}
 }
diff --git a/package.json b/package.json
index 4081858e51d1da23b12f76bee0915a80f3bbcf9a..e6fcce1e9bcd7920fea44bd627db0bd762e73aae 100644
--- a/package.json
+++ b/package.json
@@ -1,35 +1,35 @@
-{
-  "name": "SMPPIR-CheckIn-API",
-  "version": "1.0.0",
-  "main": "server/server.js",
-  "engines": {
-    "node": ">=4"
-  },
-  "scripts": {
-    "lint": "eslint .",
-    "start": "node .",
-    "posttest": "npm run lint && nsp check"
-  },
-  "dependencies": {
-    "compression": "^1.0.3",
-    "cors": "^2.5.2",
-    "helmet": "^3.12.1",
-    "loopback": "^3.0.0",
-    "loopback-boot": "^2.6.5",
-    "loopback-component-explorer": "^6.0.1",
-    "loopback-connector-postgresql": "^3.3.1",
-    "serve-favicon": "^2.0.1",
-    "strong-error-handler": "^2.0.0"
-  },
-  "devDependencies": {
-    "eslint": "^3.17.1",
-    "eslint-config-loopback": "^8.0.0",
-    "nsp": "^3.2.1"
-  },
-  "repository": {
-    "type": "",
-    "url": ""
-  },
-  "license": "UNLICENSED",
-  "description": "SMPPIR-CheckIn-API"
-}
+{
+  "name": "SMPPIR-CheckIn-API",
+  "version": "1.0.0",
+  "main": "server/server.js",
+  "engines": {
+    "node": ">=4"
+  },
+  "scripts": {
+    "lint": "eslint .",
+    "start": "node .",
+    "posttest": "npm run lint && nsp check"
+  },
+  "dependencies": {
+    "compression": "^1.0.3",
+    "cors": "^2.5.2",
+    "helmet": "^3.12.1",
+    "loopback": "^3.0.0",
+    "loopback-boot": "^2.6.5",
+    "loopback-component-explorer": "^6.0.1",
+    "loopback-connector-postgresql": "^3.3.1",
+    "serve-favicon": "^2.0.1",
+    "strong-error-handler": "^2.0.0"
+  },
+  "devDependencies": {
+    "eslint": "^3.17.1",
+    "eslint-config-loopback": "^8.0.0",
+    "nsp": "^3.2.1"
+  },
+  "repository": {
+    "type": "",
+    "url": ""
+  },
+  "license": "UNLICENSED",
+  "description": "SMPPIR-CheckIn-API"
+}
diff --git a/server/boot/access-control.js b/server/boot/access-control.js
index 488b10f126a1f86905191f84f7f4f65729c47af2..f85a2e18a6ddef4947368f53600873411d190d89 100644
--- a/server/boot/access-control.js
+++ b/server/boot/access-control.js
@@ -43,24 +43,32 @@ module.exports = function(app) {
         if (!userId) {
           return reject();
         }
+        else{
+            console.log("USER ID ::",userId)
+        }
     
+        console.log("ROLE ::", role)
+
+        console.log("CONTEXT MODEL ::", context.model)
+        console.log("CONTEXT ID ::", context.id)
+  
         // check if userId is in team table for the given project id
-        context.model.findById(context.modelId, function(err, model) {
-            if (err || !model)
-                return reject();
-        
-            var EndUser = app.models.EndUser;
-            EndUser.count({
-                ownerId: model.ownerId,
-                memberId: userId
-            }, function(err, count) {
-                if (err) {
-                    console.log(err);
-                    return cb(null, false);
-                }
-        
-                cb(null, count > 0); // true = is a team member
-            });
+        context.model.findById(userId, function(err, model) {
+
+            app.models.EndUser.findById(userId, function(err2, user){
+                console.log("ERR ::", err)
+                console.log("ERR 2::", err2)
+                console.log("MODEL ::", model)
+
+                console.log("ENDUSER MODEL", user)
+
+                if (err || err2 || !user || !model)
+                    return reject();
+                if(user.permission !== role)
+                    return reject();
+                else 
+                    return cb(null,true)
+            })            
         });
     });
 
@@ -91,7 +99,7 @@ module.exports = function(app) {
         // do not allow anonymous users
         var userId = context.accessToken.userId;
         if (!userId) {
-        return reject();
+            return reject();
         }
 
         // check if userId is in team table for the given project id
diff --git a/server/boot/authentication.js b/server/boot/authentication.js
index 7fd9c5509f6ef940a7b99815d5780979d9343afd..8e88d4b555e29d66158a7ad189f8abe16fed235f 100644
--- a/server/boot/authentication.js
+++ b/server/boot/authentication.js
@@ -2,5 +2,5 @@
 
 module.exports = function enableAuthentication(server) {
   // enable authentication
-  // server.enableAuth();
+  server.enableAuth();
 };