code: function accessControl () {
      // if the query is for specific record(s) by id then the action type
      // is read. for all other queries the action type is list.
      this.action = defined(this.args.where.id) ? 'read' : 'list'
      // if allow override is set then skip access control
      if (this.args.allow) {
          return
      }
      // get global access control instance
      var accessControl = ImmutableAccessControl.getGlobal()
      // add scope of access allowed to args
      this.args.scope = accessControl.allowModelScope({
          action: this.action,
          model: this.model.name,
          session: this.session,
          states: this.accessControlStates(),
      })
      // if scope is undefined then throw access denied error
      if (!defined(this.args.scope)) {
          httpError(403, null, accessControl.audit)
      }
      // if scope is own add access control args
      if (this.args.scope === 'own') {
          this.accessControlOwn(accessControl)
      }
  }
docs: @function accessControl
  
  check access for query, add any access control related params to args
  
  @throws {Error}