diff --git a/SecurityAgent/AccessControlList.cpp b/SecurityAgent/AccessControlList.cpp
new file mode 100644
index 0000000000..a011096e4e
--- /dev/null
+++ b/SecurityAgent/AccessControlList.cpp
@@ -0,0 +1,30 @@
+/*
+ * If not stated otherwise in this file or this component's LICENSE file the
+ * following copyright and licenses apply:
+ *
+ * Copyright 2020 RDK Management
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Module.h"
+#include "AccessControlList.h"
+
+namespace WPEFramework {
+
+    ENUM_CONVERSION_BEGIN(Plugin::AccessControlList::mode)
+        { Plugin::AccessControlList::ALLOWED, _TXT("allowed") },
+        { Plugin::AccessControlList::BLOCKED, _TXT("blocked") },
+    ENUM_CONVERSION_END(Plugin::AccessControlList::mode)
+
+}
\ No newline at end of file
diff --git a/SecurityAgent/AccessControlList.h b/SecurityAgent/AccessControlList.h
index cef847dbd9..761af43df0 100644
--- a/SecurityAgent/AccessControlList.h
+++ b/SecurityAgent/AccessControlList.h
@@ -26,18 +26,18 @@
 // helper functions
 namespace {
     
-    void ReplaceString(std::string& subject, const std::string& search,const std::string& replace) 
+    void ReplaceString(string& subject, const string& search,const string& replace) 
     {
         size_t pos = 0;
-        while ((pos = subject.find(search, pos)) != std::string::npos) {
+        while ((pos = subject.find(search, pos)) != string::npos) {
              subject.replace(pos, search.length(), replace);
              pos += replace.length();
         }
     }
     
-    std::string CreateRegex(const std::string& input)
+    string CreateRegex(const string& input)
     {
-        std::string regex = input;
+        string regex = input;
         
         // order of replacing is important
         ReplaceString(regex,"*","^[a-zA-Z0-9.]+$");
@@ -46,9 +46,9 @@ namespace {
         return regex;
     }
     
-    std::string CreateUrlRegex(const std::string& input)
+    string CreateUrlRegex(const string& input)
     {
-        std::string regex = input;
+        string regex = input;
         
         // order of replacing is important
         ReplaceString(regex,"/","\\/");
@@ -63,7 +63,6 @@ namespace {
         
         return regex;
     }
-
 }
 
 namespace WPEFramework {
@@ -73,51 +72,98 @@ namespace Plugin {
     //if Block then check for Block[] and block if present
     //else must be explicitly allowed
 
+    // "xreapps.net": {
+    //   "thunder": {
+    //     "default": "blocked",
+    //     "DeviceInfo": {
+    //       "default": "allowed",
+    //       "methods": [ "register", "unregister" ]
+    //     }
+    //   }
+    // },
+
     class EXTERNAL AccessControlList {
+    public:
+        enum mode {
+            BLOCKED,
+            ALLOWED
+        };
     private:
         class EXTERNAL JSONACL : public Core::JSON::Container {
         public:
-            class Config : public Core::JSON::Container {
+            class Plugins : public Core::JSON::Container {
+            public:
+                class Rules : public Core::JSON::Container {
+                public:
+                    Rules(const Rules&) = delete;
+                    Rules& operator=(const Rules&) = delete;
+
+                    Rules()
+                        : Core::JSON::Container()
+                        , Default(BLOCKED)
+                        , Methods()
+                    {
+                        Add(_T("default"), &Default);
+                        Add(_T("methods"), &Methods);
+                    }
+                    ~Rules() override
+                    {
+                    }
+
+                public:
+                    Core::JSON::EnumType<mode> Default;
+                    Core::JSON::ArrayType<Core::JSON::String> Methods;
+                };
+ 
+                using PluginsMap = std::map<string, Rules>;
+
             public:
-                Config(const Config&) = delete;
-                Config& operator=(const Config&) = delete;
+                using Iterator = Core::IteratorMapType<const PluginsMap, const Rules&, const string&, PluginsMap::const_iterator>;
+
+                Plugins(const Plugins&) = delete;
+                Plugins& operator=(const Plugins&) = delete;
 
-                Config()
+                Plugins()
+                    : Core::JSON::Container()
+                    , Default(BLOCKED)
+                    , _plugins()
                 {
-                    Add(_T("allow"), &Allow);
-                    Add(_T("block"), &Block);
+                    Add(_T("default"), &Default);
                 }
-                virtual ~Config()
+                ~Plugins() override
                 {
                 }
 
             public:
-                Core::JSON::ArrayType<Core::JSON::String> Allow;
-                Core::JSON::ArrayType<Core::JSON::String> Block;
-            };
-            class Role : public Core::JSON::Container {
-            public:
-                Role(const Role&) = delete;
-                Role& operator=(const Role&) = delete;
+                Core::JSON::EnumType<mode> Default;
 
-                Role()
-                    : Configuration()
+                inline Iterator Elements() const
                 {
-                    Add(_T("thunder"), &Configuration);
+                    return (Iterator(_plugins));
                 }
-                virtual ~Role()
+
+            private:
+                virtual bool Request(const TCHAR label[])
                 {
+                    if (_plugins.find(label) == _plugins.end()) {
+                        auto element = _plugins.emplace(std::piecewise_construct,
+                            std::forward_as_tuple(label),
+                            std::forward_as_tuple());
+                        Add(element.first->first.c_str(), &(element.first->second));
+                    }
+                    return (true);
                 }
 
-            public:
-                Config Configuration;
+            private:
+                PluginsMap _plugins;
             };
+
             class Roles : public Core::JSON::Container {
             private:
-                using RolesMap = std::map<string, Role>;
+                using RolesMap = std::map<string, Plugins>;
 
             public:
-                using Iterator = Core::IteratorMapType<const RolesMap, const Role&, const string&, RolesMap::const_iterator>;
+                using Iterator = Core::IteratorMapType<const RolesMap, const Plugins&, const string&, RolesMap::const_iterator>;
 
                 Roles(const Roles&) = delete;
                 Roles& operator=(const Roles&) = delete;
@@ -205,23 +251,63 @@ namespace Plugin {
 
     public:
         class Filter {
+        private:
+            class Plugin {
+            public:
+                Plugin() = delete;
+                Plugin(const Plugin&) = delete;
+                Plugin& operator= (const Plugin&) = delete;
+
+                Plugin (const JSONACL::Plugins::Rules& rules)
+                    : _defaultBlocked(rules.Default.Value() == mode::BLOCKED) 
+                    , _methods() {
+                    Core::JSON::ArrayType<Core::JSON::String>::ConstIterator index(rules.Methods.Elements());
+                    while (index.Next() == true) {
+                        string str = index.Current().Value();
+                        _methods.emplace_back(CreateRegex(str));
+                    }
+                }
+                ~Plugin() {
+                }
+
+            public:
+                bool Allowed(const string& method) const
+                {
+                    bool found = false;
+
+                    std::list<string>::const_iterator index(_methods.begin());
+
+                    while ((index != _methods.end()) && (found == false)) { 
+                        std::regex expression(index->c_str());
+                        std::smatch matchList;
+                        found = std::regex_search(method, matchList, expression);
+                        if (found == false) {
+                            index++;
+                        }
+                    }
+                    return !(_defaultBlocked ^ found);
+                }
+
+            private:
+                bool _defaultBlocked;
+                std::list<string> _methods;
+            };
+
         public:
             Filter() = delete;
             Filter(const Filter&) = delete;
             Filter& operator=(const Filter&) = delete;
 
-            Filter(const JSONACL::Config& filter)
+            Filter(const JSONACL::Plugins& plugins)
+                : _defaultBlocked(plugins.Default.Value() == mode::BLOCKED)
+                , _plugins()
             {
-                Core::JSON::ArrayType<Core::JSON::String>::ConstIterator index(filter.Allow.Elements());
-                std::string str;
-                while (index.Next() == true) {
-                    str = index.Current().Value();
-                    _allow.emplace_back(CreateRegex(str));
-                }
-                index = (filter.Block.Elements());
+                JSONACL::Plugins::Iterator index(plugins.Elements());
+          
                 while (index.Next() == true) {
-                    str = index.Current().Value();
-                    _block.emplace_back(CreateRegex(str));
+                    _plugins.emplace(std::piecewise_construct,
+                            std::forward_as_tuple(CreateRegex(index.Key())),
+                            std::forward_as_tuple(index.Current()));
                 }
             }
             ~Filter()
@@ -229,34 +315,26 @@ namespace Plugin {
             }
 
         public:
-            bool Allowed(const string& method) const
+            bool Allowed(const string callsign, const string& method) const
             {
-                bool allowed = false;
-                if (_allowSet) {
-                    std::list<string>::const_iterator index(_allow.begin());
-                    while ((index != _allow.end()) && (allowed == false)) { 
-                        std::regex expression(index->c_str());
-                        std::smatch matchList;
-                        allowed = std::regex_search(method, matchList, expression);
-                        index++;
-                    }
-                } else {
-                    allowed = true;
-                    std::list<string>::const_iterator index(_block.begin());
-                    while ((index != _block.end()) && (allowed == true)) {
-                        std::regex expression(index->c_str());
-                        std::smatch matchList;
-                        allowed = !std::regex_search(method, matchList, expression);
+                bool pluginFound = false;
+
+                std::map<string, Plugin>::const_iterator index(_plugins.begin());
+                while ((index != _plugins.end()) && (pluginFound == false)) {
+                    std::regex expression(index->first.c_str());
+                    std::smatch matchList;
+                    pluginFound = std::regex_search(callsign, matchList, expression);
+                    if (pluginFound == false) {
                         index++;
                     }
                 }
-                return (allowed);
+
+                return (pluginFound == false ? !_defaultBlocked : index->second.Allowed(method));
             }
 
         private:
-            bool _allowSet;
-            std::list<string> _allow;
-            std::list<string> _block;
+            bool _defaultBlocked;
+            std::map<string, Plugin> _plugins;
         };
 
         using URLList = std::list<std::pair<string, Filter&>>;
@@ -308,7 +386,9 @@ namespace Plugin {
                 if (std::regex_search(URL, matchList, expression) == true) {
                     result = &(index->second);
                 }
-                index++;
+                else {
+                    index++;
+                }
             }
 
             return (result);
@@ -333,7 +413,7 @@ namespace Plugin {
 
                 _filterMap.emplace(std::piecewise_construct,
                     std::forward_as_tuple(roleName),
-                    std::forward_as_tuple(rolesIndex.Current().Configuration));
+                    std::forward_as_tuple(rolesIndex.Current()));
             }
 
             Core::JSON::ArrayType<JSONACL::Group>::Iterator index = controlList.Groups.Elements();
@@ -354,7 +434,7 @@ namespace Plugin {
                     Filter& entry(selectedFilter->second);
                     
                     // create regex for url
-                    std::string url_regex = CreateUrlRegex(index.Current().URL.Value());
+                    string url_regex = CreateUrlRegex(index.Current().URL.Value());
                     
                     _urlMap.emplace_back(std::pair<string, Filter&>(
                         url_regex, entry));
diff --git a/SecurityAgent/CMakeLists.txt b/SecurityAgent/CMakeLists.txt
index 40b35823dc..a257687fdf 100644
--- a/SecurityAgent/CMakeLists.txt
+++ b/SecurityAgent/CMakeLists.txt
@@ -22,6 +22,7 @@ find_package(${NAMESPACE}Plugins REQUIRED)
 find_package(CompileSettingsDebug CONFIG REQUIRED)
 
 add_library(${MODULE_NAME} SHARED 
+    AccessControlList.cpp
     SecurityAgent.cpp
     SecurityContext.cpp
     SecurityAgentJsonRpc.cpp
diff --git a/SecurityAgent/SecurityAgent.cpp b/SecurityAgent/SecurityAgent.cpp
index 33150b8a1c..6d031971dc 100644
--- a/SecurityAgent/SecurityAgent.cpp
+++ b/SecurityAgent/SecurityAgent.cpp
@@ -211,6 +211,7 @@ namespace Plugin {
 
 		if (index.Next() == true) {
             // We might be receiving a plugin download request.
+            #ifdef SECURITY_TESTING_MODE
             if ((request.Verb == Web::Request::HTTP_PUT) && (request.HasBody() == true)) {
                 if (index.Current() == _T("Token")) {
                     Core::ProxyType<const Web::TextBody> data(request.Body<Web::TextBody>());
@@ -224,12 +225,15 @@ namespace Plugin {
 
                             result->Body(token);
                             result->ContentType = Web::MIMETypes::MIME_TEXT;
-                            result->ErrorCode = Core::ERROR_NONE;
+                            result->ErrorCode = Web::STATUS_OK;
                             result->Message = "Ok";
                         }
                     }
                 }
-            } else if ( (request.Verb == Web::Request::HTTP_GET) && (index.Current() == _T("Valid")) ) {
+            } else
+            #endif      
+
+            if ( (request.Verb == Web::Request::HTTP_GET) && (index.Current() == _T("Valid")) ) {
                 result->ErrorCode = Web::STATUS_FORBIDDEN;
                 result->Message = _T("Missing token");
 
diff --git a/SecurityAgent/SecurityAgent.h b/SecurityAgent/SecurityAgent.h
index 5635e5520c..851a3f4403 100644
--- a/SecurityAgent/SecurityAgent.h
+++ b/SecurityAgent/SecurityAgent.h
@@ -152,7 +152,9 @@ namespace Plugin {
         // -------------------------------------------------------------------------------------------------------
         void RegisterAll();
         void UnregisterAll();
-        uint32_t endpoint_createtoken(const JsonData::SecurityAgent::CreatetokenParamsData& params, JsonData::SecurityAgent::CreatetokenResultInfo& response);
+        #ifdef SECURITY_TESTING_MODE
+        uint32_t endpoint_createtoken(const JsonData::SecurityAgent::CreatetokenParamsData& params, JsonData::SecurityAgent::CreatetokenResultInfo& response);
+        #endif // DEBUG
         uint32_t endpoint_validate(const JsonData::SecurityAgent::CreatetokenResultInfo& params, JsonData::SecurityAgent::ValidateResultData& response);
 
 
diff --git a/SecurityAgent/SecurityAgent.vcxproj b/SecurityAgent/SecurityAgent.vcxproj
index 8bea3e9a0c..e824b55109 100644
--- a/SecurityAgent/SecurityAgent.vcxproj
+++ b/SecurityAgent/SecurityAgent.vcxproj
@@ -19,6 +19,7 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
+    <ClCompile Include="AccessControlList.cpp" />
     <ClCompile Include="Module.cpp" />
     <ClCompile Include="SecurityAgent.cpp" />
     <ClCompile Include="SecurityAgentJsonRpc.cpp" />
@@ -117,9 +118,9 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <SDLCheck>true</SDLCheck>
-      <PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;_DEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_TESTING_MODE;_CRT_SECURE_NO_WARNINGS;_DEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir)thirdparty/windows/include;$(SolutionDir)thirdparty/windows/include/zlib;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -133,9 +134,9 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <SDLCheck>true</SDLCheck>
-      <PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;WIN32;_DEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_TESTING_MODE;_CRT_SECURE_NO_WARNINGS;WIN32;_DEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir)thirdparty/windows/include;$(SolutionDir)thirdparty/windows/include/zlib;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -151,9 +152,9 @@
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
-      <PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;WIN32;NDEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_TESTING_MODE;_CRT_SECURE_NO_WARNINGS;WIN32;NDEBUG;SECURITYOFFICER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir)thirdparty/windows/include;$(SolutionDir)thirdparty/windows/include/zlib;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -171,9 +172,9 @@
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
-      <PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;NDEBUG;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>SECURITY_TESTING_MODE;_CRT_SECURE_NO_WARNINGS;NDEBUG;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
-      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>$(ProjectDir)../../;$(SolutionDir)thirdparty/windows/include;$(SolutionDir)thirdparty/windows/include/zlib;$(SolutionDir);$(SolutionDir)src/base</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
diff --git a/SecurityAgent/SecurityAgent.vcxproj.filters b/SecurityAgent/SecurityAgent.vcxproj.filters
index fffcdd9023..6fe8c86ab4 100644
--- a/SecurityAgent/SecurityAgent.vcxproj.filters
+++ b/SecurityAgent/SecurityAgent.vcxproj.filters
@@ -13,6 +13,9 @@
     <ClCompile Include="SecurityAgentJsonRpc.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="AccessControlList.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="AccessControlList.h">
diff --git a/SecurityAgent/SecurityAgentJsonRpc.cpp b/SecurityAgent/SecurityAgentJsonRpc.cpp
index 369d31beb3..50562896c9 100644
--- a/SecurityAgent/SecurityAgentJsonRpc.cpp
+++ b/SecurityAgent/SecurityAgentJsonRpc.cpp
@@ -32,19 +32,25 @@ namespace Plugin {
 
     void SecurityAgent::RegisterAll()
     {
+        #ifdef SECURITY_TESTING_MODE
         Register<CreatetokenParamsData,CreatetokenResultInfo>(_T("createtoken"), &SecurityAgent::endpoint_createtoken, this);
+        #endif  
+
         Register<CreatetokenResultInfo,ValidateResultData>(_T("validate"), &SecurityAgent::endpoint_validate, this);
     }
 
     void SecurityAgent::UnregisterAll()
     {
         Unregister(_T("validate"));
+        #ifdef SECURITY_TESTING_MODE
         Unregister(_T("createtoken"));
+        #endif
     }
 
     // API implementation
     //
 
+    #ifdef SECURITY_TESTING_MODE
     // Method: createtoken - Creates Token
     // Return codes:
     //  - ERROR_NONE: Success
@@ -64,6 +70,7 @@ namespace Plugin {
 
         return result;
     }
+    #endif
 
     // Method: validate - Creates Token
     // Return codes:
diff --git a/SecurityAgent/SecurityContext.cpp b/SecurityAgent/SecurityContext.cpp
index fab8308ac3..34d937f053 100644
--- a/SecurityAgent/SecurityContext.cpp
+++ b/SecurityAgent/SecurityContext.cpp
@@ -53,9 +53,10 @@ namespace WPEFramework {
 namespace Plugin {
 
     SecurityContext::SecurityContext(const AccessControlList* acl, const uint16_t length, const uint8_t payload[])
-        : _accessControlList(nullptr)
+        : _token(string(reinterpret_cast<const TCHAR*>(payload), length))
+        , _accessControlList(nullptr)
     {
-        _context.FromString(string(reinterpret_cast<const TCHAR*>(payload), length));
+        _context.FromString(_token);
 
         if ( (_context.URL.IsSet() == true) && (acl != nullptr) ) {
             _accessControlList = acl->FilterMapFromURL(_context.URL.Value());
@@ -77,9 +78,8 @@ namespace Plugin {
     {
         bool allowed = (_accessControlList != nullptr);
 
-		if (allowed == true) {
-			
-		}
+        if (allowed == true) {
+        }
 
         return (allowed);
     }
@@ -87,7 +87,13 @@ namespace Plugin {
     //! Allow a JSONRPC message to be checked before it is offered for processing.
     bool SecurityContext::Allowed(const Core::JSONRPC::Message& message) const /* override */ 
     {
-        return ((_accessControlList != nullptr) && (_accessControlList->Allowed(message.Callsign())));
+        return ((_accessControlList != nullptr) && (_accessControlList->Allowed(message.Callsign(), message.Method())));
     }
+
+    string SecurityContext::Token() const /* override */
+    {
+        return (_token);
+    }
+
 }
 }
diff --git a/SecurityAgent/SecurityContext.h b/SecurityAgent/SecurityContext.h
index c5f92e0518..8685e5dd08 100644
--- a/SecurityAgent/SecurityContext.h
+++ b/SecurityAgent/SecurityContext.h
@@ -69,6 +69,8 @@ namespace Plugin {
         //! Allow a JSONRPC message to be checked before it is offered for processing.
         bool Allowed(const Core::JSONRPC::Message& message) const override;
 
+        string Token() const override;
+
     private:
         // Build QueryInterface implementation, specifying all possible interfaces to be returned.
         BEGIN_INTERFACE_MAP(SecurityOfficer)
@@ -76,6 +78,7 @@ namespace Plugin {
         END_INTERFACE_MAP
 
     private:
+        string _token;
         Payload _context;
         const AccessControlList::Filter* _accessControlList;
     };
diff --git a/SecurityAgent/TestPage.html b/SecurityAgent/TestPage.html
new file mode 100644
index 0000000000..a7cb19da4d
--- /dev/null
+++ b/SecurityAgent/TestPage.html
@@ -0,0 +1,83 @@
+<html>
+
+<head>
+<script>
+/**
+ * If not stated otherwise in this file or this component's LICENSE file the
+ * following copyright and licenses apply:
+ *
+ * Copyright 2020 RDK Management
+ *
+ * Licensed under the Apache License, Version 2.0 (the License);
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var ThunderJS=function(){"use strict";function h(n){return(h="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n})(n)}function e(e,n){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);n&&(r=r.filter(function(n){return Object.getOwnPropertyDescriptor(e,n).enumerable})),t.push.apply(t,r)}return t}function t(o){for(var n=1;n<arguments.length;n++){var i=null!=arguments[n]?arguments[n]:{};n%2?e(Object(i),!0).forEach(function(n){var e,t,r;e=o,r=i[t=n],t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r}):Object.getOwnPropertyDescriptors?Object.defineProperties(o,Object.getOwnPropertyDescriptors(i)):e(Object(i)).forEach(function(n){Object.defineProperty(o,n,Object.getOwnPropertyDescriptor(i,n))})}return o}var n=null;"undefined"!=typeof WebSocket&&(n=WebSocket);function i(e){if("string"==typeof e&&(e=JSON.parse(e.normalize().replace(/\\x([0-9A-Fa-f]{2})/g,""))),!e.id&&e.method){var n=s[e.method];n&&Array.isArray(n)&&n.length&&n.forEach(function(n){n(e.params)})}}function v(o){return new Promise(function(e,t){if(u&&1===u.readyState)return e(u);if(u&&0===u.readyState){return u.addEventListener("open",function n(){u.removeEventListener("open",n),e(u)})}if(null===u){(u=new c([(r=o)&&r.protocol||"ws://",r&&r.host||"localhost",":"+(r&&r.port||80),r&&r.endpoint||"/jsonrpc",r&&r.token?"?token="+r.token:null].join(""),"notification")).addEventListener("message",function(n){o.debug&&(console.log(" "),console.log("API REPONSE:"),console.log(JSON.stringify(n.data,null,2)),console.log(" ")),function(n){if("string"==typeof n&&(n=JSON.parse(n.normalize().replace(/\\x([0-9A-Fa-f]{2})/g,""))),n.id){var e=g[n.id];e?("result"in n?e.resolve(n.result):e.reject(n.error),delete g[n.id]):console.log("no pending request found with id "+n.id)}}(n.data)}),u.addEventListener("message",function(n){i(n.data)}),u.addEventListener("error",function(){i({method:"client.ThunderJS.events.error"}),u=null});var n=function(n){u=null,t(n)};u.addEventListener("close",n),u.addEventListener("open",function(){i({method:"client.ThunderJS.events.connect"}),u.removeEventListener("close",n),u.addEventListener("close",function(){i({method:"client.ThunderJS.events.disconnect"}),u=null}),e(u)})}else u=null,t("Socket error");var r})}function r(d){return{request:function(f,a,p){return new Promise(function(n,e){var t,r,o,i,c,u=y+=1,s=(t=d.versions,r=f,(i=(o=p)&&o.version)?i:t&&(t[r]||t.default)||1),l=function(n,e,t,r,o){r&&delete r.version;var i={jsonrpc:"2.0",id:n,method:[e,o,t].join(".")};return!r&&!1!==r||"object"===h(r)&&0===Object.keys(r).length||(i.params=r),i}(u,f,a,p,s);d.debug&&(console.log(" "),console.log("API REQUEST:"),console.log(JSON.stringify(l,null,2)),console.log(" ")),g[u]={body:l,resolve:n,reject:e},c=l,v(d).then(function(n){n.send(JSON.stringify(c))}).catch(function(n){e(n)})})}}}var c=n,g={},s={},u=null,y=0,o={DeviceInfo:{freeRam:function(n){return this.call("systeminfo",n).then(function(n){return n.freeram})},version:function(n){return this.call("systeminfo",n).then(function(n){return n.version})}}};function l(e,t,n,r){var o=this,i=function(n,e,t,r){var o=f(n,e);if(!s[o]){s[o]=[];if(n!=="ThunderJS"){var i="register";var c=o.split(".").slice(0,-1).join(".");var u={event:e,id:c};this.api.request(n,i,u).catch(function(n){if(typeof r==="function")r(n.message)})}}return s[o].push(t),s[o].length-1}.call(this,e,t,n,r);return{dispose:function(){var n=f(e,t);s[n].splice(i,1),0===s[n].length&&function(n,e,t){var r=f(n,e);if(delete s[r],n!=="ThunderJS"){var o="unregister";var i=r.split(".").slice(0,-1).join(".");var c={event:e,id:i};this.api.request(n,o,c).catch(function(n){if(typeof t==="function")t(n.message)})}}.call(o,e,t,r)}}}function f(n,e){return["client",n,"events",e].join(".")}var a,p=function t(n){return{options:n,plugin:!1,call:function(){var n=Array.prototype.slice.call(arguments);this.plugin&&n[0]!==this.plugin&&n.unshift(this.plugin);var e=n[0],t=n[1];return"function"==typeof this[e][t]?this[e][t](n[2]):this.api.request.apply(this,n)},registerPlugin:function(n,e){this[n]=d(Object.assign(Object.create(t),e,{plugin:n}))},subscribe:function(){},on:function(){var n=Array.prototype.slice.call(arguments);return-1!==["connect","disconnect","error"].indexOf(n[0])?n.unshift("ThunderJS"):this.plugin&&n[0]!==this.plugin&&n.unshift(this.plugin),l.apply(this,n)},once:function(){console.log("todo ...")}}},d=function n(e){return new Proxy(e,{get:function(r,o){var i=r[o];return"api"===o?a:void 0!==i?"function"==typeof i?-1<["on","once","subscribe"].indexOf(o)?function(){for(var n=arguments.length,e=new Array(n),t=0;t<n;t++)e[t]=arguments[t];return i.apply(this,e)}:function(){for(var n=arguments.length,e=new Array(n),t=0;t<n;t++)e[t]=arguments[t];return function(t,n){"object"===h(t)&&("object"!==h(t)||t.then&&"function"==typeof t.then)||(t=new Promise(function(n,e){(t instanceof Error==!1?n:e)(t)}));var e="function"==typeof n[n.length-1]?n[n.length-1]:null;if(!e)return t;t.then(function(n){return e(null,n)}).catch(function(n){return e(n)})}(i.apply(this,e),e)}:"object"===h(i)?n(Object.assign(Object.create(p(r.options)),i,{plugin:o})):i:!1===r.plugin?n(Object.assign(Object.create(p(r.options)),{},{plugin:o})):function(){for(var n=arguments.length,e=new Array(n),t=0;t<n;t++)e[t]=arguments[t];return e.unshift(o),r.call.apply(this,e)}}})};return function(n){return void 0===n.token&&"undefined"!=typeof window&&window.thunder&&"function"==typeof window.thunder.token&&(n.token=window.thunder.token()),a=r(n),d(t({},p(n),{},o))}}();
+</script>
+</head>
+<body>
+
+token body
+<input type="text" id="tokenBody" /> <button onclick="connectWithToken()">reconnect with token</button>
+<br />
+<br />
+
+callsign
+<input type="text" id="callsign" /> <br/>
+method<input type="text" id="method" /> <br/>
+params <input type="text" id="params" /> <br/>
+<button onclick="request()">request</button>
+
+<script>
+
+var ip = '192.168.1.128'
+var port = 8080
+var withTokenJS = null;
+
+
+
+
+var payload = localStorage.getItem('token');
+document.getElementById('tokenBody').value = payload;
+function connectWithToken() {
+	var temp = document.getElementById('tokenBody').value;
+	localStorage.setItem('token', temp);
+	
+
+	var xhr = new XMLHttpRequest();
+	xhr.open('PUT', 'http://' + ip + ':' + port + '/Service/SecurityAgent/Token' , true);
+
+	xhr.onreadystatechange = function() {
+		if (this && this.readyState === 4) {
+			if (this.status === 200) {
+						withTokenJS = new ThunderJS({host: ip, port: port, token: this.responseText});
+				console.log('connecting with token: ', this.responseText);
+			}
+		}
+    }
+	xhr.send(payload);
+
+}
+
+function request(){
+	var callsign = document.getElementById('callsign').value;
+	var method = document.getElementById('method').value;
+	var params = document.getElementById('params').value;
+
+	console.log(callsign, method, params)
+	if (params) params  = JSON.parse(params)
+	withTokenJS.call(callsign, method, params).then((res) => {console.log(res)}).catch((err)=> {console.error(err)});
+}
+
+</script>
+</body>
+</html>
diff --git a/SecurityAgent/example_acl.json b/SecurityAgent/example_acl.json
index 0991e5ebbd..eec0089369 100644
--- a/SecurityAgent/example_acl.json
+++ b/SecurityAgent/example_acl.json
@@ -40,90 +40,6 @@
       "url": "*://*.comcast.com",
       "role": "comcast"
     },
-    {
-      "url": "*://*.comcast.com:*",
-      "role": "comcast"
-    },
-    {
-      "url": "*://*.comcast.net",
-      "role": "comcast"
-    },
-    {
-      "url": "*://*.comcast.net:*",
-      "role": "comcast"
-    },
-    {
-      "url": "*.x1.xcal.tv",
-      "role": "comcast"
-    },
-    {
-      "url": "*.x1.xcal.tv:*",
-      "role": "comcast"
-    },
-    {
-      "url": "*.x1-app.xcr.comcast.net",
-      "role": "comcast"
-    },
-    {
-      "url": "*.x1-app.xcr.comcast.net:*",
-      "role": "comcast"
-    },
-    {
-      "url": "*://www.pxscene.org",
-      "role": "pxscene.org"
-    },
-    {
-      "url": "*://www.pxscene.org:*",
-      "role": "pxscene.org"
-    },
-    {
-      "url": "*://pxscene.org",
-      "role": "pxscene.org"
-    },
-    {
-      "url": "*://pxscene.org:*",
-      "role": "pxscene.org"
-    },
-    {
-      "url": "*://www.sparkui.org",
-      "role": "sparkui.org"
-    },
-    {
-      "url": "*://www.sparkui.org:*",
-      "role": "sparkui.org"
-    },
-    {
-      "url": "*://sparkui.org",
-      "role": "sparkui.org"
-    },
-    {
-      "url": "*://sparkui.org:*",
-      "role": "sparkui.org"
-    },
-    {
-      "url": "*://xre2-apps.cvs-a.ula.comcast.net",
-      "role": "pxscene-samples"
-    },
-    {
-      "url": "*://xre2-apps.cvs-a.ula.comcast.net:*",
-      "role": "pxscene-samples"
-    },
-    {
-      "url": "*://px-apps.sys.comcast.net",
-      "role": "pxscene-samples"
-    },
-    {
-      "url": "*://px-apps.sys.comcast.net:*",
-      "role": "pxscene-samples"
-    },
-    {
-      "url": "*://*.xreapps.net",
-      "role": "xreapps.net"
-    },
-    {
-      "url": "*://tvxcts-c5-c00001-b.ch.tvx.comcast.com",
-      "role": "cts"
-    },
     {
       "url": "*://metrological.com",
       "role": "metrological"
@@ -135,85 +51,26 @@
   ],
   "roles": {
     "default" : {
-      "thunder": {
-        "block" : [
-            "*"
-        ]
-      }
-    },
-    "xreapps.net": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-            "DeviceInfo"
-        ]
-      }
+      "default" : "blocked"
     },
-    "local": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-        ]
-      }
-    },
-    "comcast": {
-      "thunder": {
-        "allow": [
-          "DeviceInfo"
-        ],
-        "block" : [
-        ]
-      }
+	"local" : {
+      "default" : "allowed"
     },
     "metrological": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-        ]
-      }
-    },
-    "pxscene.org": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-        ]
-      }
-    },
-    "pxscene-samples": {
-     "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-        ]
-      }
-    },
-    "cts": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-        "DeviceInfo"
-        ]
-      }
+      "default": "blocked",
+      "DeviceInfo": {
+        "default": "allowed",
+        "methods": [ "register", "unregister" ]
+      },
+	  "JSONRPCPlugin": {
+		"default": "blocked",
+		"methods": [ "time", "status" ]
+	  }
     },
-    "sparkui.org": {
-      "thunder": {
-        "allow": [
-          "*"
-        ],
-        "block" : [
-            "DeviceInfo"
-        ]
+    "comcast": {
+      "default": "blocked",
+      "Compositor": {
+        "default": "allowed"
       }
     }
   }