access to sensitive or restricted information is controlled