diff --git a/coordinator/coordinatorclient/coordinatorclient.go b/coordinator/coordinatorclient/coordinatorclient.go
index ea67c891..a8e00da6 100644
--- a/coordinator/coordinatorclient/coordinatorclient.go
+++ b/coordinator/coordinatorclient/coordinatorclient.go
@@ -8,6 +8,7 @@ import (
 	"storj.io/drpc"
 
 	"github.com/anyproto/any-sync/app"
+	"github.com/anyproto/any-sync/consensus/consensusproto"
 	"github.com/anyproto/any-sync/coordinator/coordinatorproto"
 	"github.com/anyproto/any-sync/identityrepo/identityrepoproto"
 	"github.com/anyproto/any-sync/net/peer"
@@ -42,6 +43,10 @@ type CoordinatorClient interface {
 
 	IdentityRepoPut(ctx context.Context, identity string, data []*identityrepoproto.Data) (err error)
 	IdentityRepoGet(ctx context.Context, identities []string, kinds []string) (res []*identityrepoproto.DataWithIdentity, err error)
+
+	AclAddRecord(ctx context.Context, spaceId string, rec *consensusproto.RawRecord) (res *consensusproto.RawRecordWithId, err error)
+	AclGetRecords(ctx context.Context, spaceId, aclHead string) (res []*consensusproto.RawRecordWithId, err error)
+
 	app.Component
 }
 
@@ -258,6 +263,49 @@ func (c *coordinatorClient) IdentityRepoGet(ctx context.Context, identities, kin
 	return
 }
 
+func (c *coordinatorClient) AclAddRecord(ctx context.Context, spaceId string, rec *consensusproto.RawRecord) (res *consensusproto.RawRecordWithId, err error) {
+	recordData, err := rec.Marshal()
+	if err != nil {
+		return
+	}
+	err = c.doClient(ctx, func(cl coordinatorproto.DRPCCoordinatorClient) error {
+		resp, err := cl.AclAddRecord(ctx, &coordinatorproto.AclAddRecordRequest{
+			SpaceId: spaceId,
+			Payload: recordData,
+		})
+		if err != nil {
+			return err
+		}
+		res = &consensusproto.RawRecordWithId{
+			Payload: resp.Payload,
+			Id:      resp.RecordId,
+		}
+		return nil
+	})
+	return
+}
+
+func (c *coordinatorClient) AclGetRecords(ctx context.Context, spaceId, aclHead string) (res []*consensusproto.RawRecordWithId, err error) {
+	err = c.doClient(ctx, func(cl coordinatorproto.DRPCCoordinatorClient) error {
+		resp, err := cl.AclGetRecords(ctx, &coordinatorproto.AclGetRecordsRequest{
+			SpaceId: spaceId,
+			AclHead: aclHead,
+		})
+		if err != nil {
+			return err
+		}
+		res = make([]*consensusproto.RawRecordWithId, len(resp.Records))
+		for i, rec := range resp.Records {
+			res[i] = &consensusproto.RawRecordWithId{}
+			if err = res[i].Unmarshal(rec); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	return
+}
+
 func (c *coordinatorClient) doClient(ctx context.Context, f func(cl coordinatorproto.DRPCCoordinatorClient) error) error {
 	p, err := c.getPeer(ctx)
 	if err != nil {
diff --git a/coordinator/coordinatorclient/mock_coordinatorclient/mock_coordinatorclient.go b/coordinator/coordinatorclient/mock_coordinatorclient/mock_coordinatorclient.go
index dc02bb17..c80c92da 100644
--- a/coordinator/coordinatorclient/mock_coordinatorclient/mock_coordinatorclient.go
+++ b/coordinator/coordinatorclient/mock_coordinatorclient/mock_coordinatorclient.go
@@ -14,6 +14,7 @@ import (
 	reflect "reflect"
 
 	app "github.com/anyproto/any-sync/app"
+	consensusproto "github.com/anyproto/any-sync/consensus/consensusproto"
 	coordinatorclient "github.com/anyproto/any-sync/coordinator/coordinatorclient"
 	coordinatorproto "github.com/anyproto/any-sync/coordinator/coordinatorproto"
 	identityrepoproto "github.com/anyproto/any-sync/identityrepo/identityrepoproto"
@@ -72,6 +73,36 @@ func (mr *MockCoordinatorClientMockRecorder) AccountRevertDeletion(arg0 any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AccountRevertDeletion", reflect.TypeOf((*MockCoordinatorClient)(nil).AccountRevertDeletion), arg0)
 }
 
+// AclAddRecord mocks base method.
+func (m *MockCoordinatorClient) AclAddRecord(arg0 context.Context, arg1 string, arg2 *consensusproto.RawRecord) (*consensusproto.RawRecordWithId, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AclAddRecord", arg0, arg1, arg2)
+	ret0, _ := ret[0].(*consensusproto.RawRecordWithId)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AclAddRecord indicates an expected call of AclAddRecord.
+func (mr *MockCoordinatorClientMockRecorder) AclAddRecord(arg0, arg1, arg2 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AclAddRecord", reflect.TypeOf((*MockCoordinatorClient)(nil).AclAddRecord), arg0, arg1, arg2)
+}
+
+// AclGetRecords mocks base method.
+func (m *MockCoordinatorClient) AclGetRecords(arg0 context.Context, arg1, arg2 string) ([]*consensusproto.RawRecordWithId, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AclGetRecords", arg0, arg1, arg2)
+	ret0, _ := ret[0].([]*consensusproto.RawRecordWithId)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AclGetRecords indicates an expected call of AclGetRecords.
+func (mr *MockCoordinatorClientMockRecorder) AclGetRecords(arg0, arg1, arg2 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AclGetRecords", reflect.TypeOf((*MockCoordinatorClient)(nil).AclGetRecords), arg0, arg1, arg2)
+}
+
 // DeletionLog mocks base method.
 func (m *MockCoordinatorClient) DeletionLog(arg0 context.Context, arg1 string, arg2 int) ([]*coordinatorproto.DeletionLogRecord, error) {
 	m.ctrl.T.Helper()