Access control on provenance