# Respecting Access Control with Local API Operations

Source: https://payloadcms.com/docs/beta/local-api/access-control

Local API operations that support `overrideAccess` now default it to `false` — they **respect Access Control by default**. A few operations do not expose this option, and `resetPassword` requires it explicitly.

- `overrideAccess: false` (default where optional) — respect Access Control. Pass the authenticated `user` when the operation acts on their behalf; without one, Payload evaluates access as an anonymous request.
- `overrideAccess: true` — skip Access Control. The operation runs with full permissions.

> **Warning**
>
> In Payload 3 this property defaulted to `true`, which meant an operation that
> said nothing skipped Access Control. See the [migration
> guide](/docs/v4/migration-guide/v4.md#overrideaccess-now-defaults-to-false-on-local-api-operations).

### Respecting Access Control

Use `overrideAccess: false` whenever the operation acts for a person — server functions, API routes, custom endpoints, and anything reached from the front end. Pass the authenticated `user` so Payload knows whose permissions to check.

```ts
const authedCreate = await payload.create({
  collection: 'users',
  overrideAccess: false, // access control is enforced
  user, // whose permissions to check
  data: {
    email: 'test@test.com',
    password: 'test',
  },
})
```

This creates the document only if `user` has permission to do so. Without the `user`, Payload treats the request as unauthenticated and applies the access rules for an anonymous visitor.

### Skipping Access Control

Use `overrideAccess: true` for trusted server-side work with no user behind it — seed scripts, migrations, cron jobs, and independently authenticated system integrations that are intended to run with full permissions.

Treat webhooks according to the authority they represent. A webhook acting for a Payload user should pass that `user` with `overrideAccess: false`. After independently authenticating and authorizing a system webhook, use `overrideAccess: true` only when it is intentionally allowed to bypass Payload Access Control.

```ts
const seeded = await payload.create({
  collection: 'users',
  overrideAccess: true, // access control is skipped
  data: {
    email: 'test@test.com',
    password: 'test',
  },
})
```

### Choosing a value

Ask who the operation is for. If a person triggered it, pass their `user` — you can set `overrideAccess: false` explicitly, or simply omit the property, since that's now the default. If your server triggered it on its own schedule, set `overrideAccess: true` explicitly.

When you are unsure, leave the default in place so that Payload enforces the configured Access Control instead of bypassing it.