not allowing authorised users to access some service

part of the DAD triad