public static function api_access_control($model, $httpMethod = 'GET')
    {
        $policy = self::config()->access_control_policy;
        if ($policy === false) {
            return true;
        } // if access control is disabled, skip
        else {
            $policy = constant('self::' . $policy);
        }

        if ($policy === self::ACL_CHECK_MODEL_ONLY) {
            $access = true;
        } else {
            $access = false;
        }

        if ($policy === self::ACL_CHECK_CONFIG_ONLY || $policy === self::ACL_CHECK_CONFIG_AND_MODEL) {
            if (!is_string($model)) {
                $className = get_class($model);
            } else {
                $className = $model;
            }

            $access = self::api_access_config_check($className, $httpMethod);
        }

        if ($policy === self::ACL_CHECK_MODEL_ONLY || $policy === self::ACL_CHECK_CONFIG_AND_MODEL) {
            if ($access) {
                $access = self::model_permission_check($model, $httpMethod);
            }
        }

        return $access;
    }