OCL operator object.canAccess(ViewModel):bool allows you to check if you can access the vm with this root object given the vm's AccessExpression.

This enables you to disable actions that will end up showing AccessDenied and allows you to stop reports from being created based on a ViewModel.