diff --git a/application/Espo/Classes/Acl/Attachment/AccessChecker.php b/application/Espo/Classes/Acl/Attachment/AccessChecker.php
index 016bfd8664..0a2c84dba2 100644
--- a/application/Espo/Classes/Acl/Attachment/AccessChecker.php
+++ b/application/Espo/Classes/Acl/Attachment/AccessChecker.php
@@ -99,10 +99,7 @@ class AccessChecker implements AccessEntityCREDChecker
         else if ($this->aclManager->checkEntity($user, $parent)) {
             if (
                 $entity->getTargetField() &&
-                in_array(
-                    $entity->getTargetField(),
-                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
-                )
+                !$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
             ) {
                 return false;
             }
diff --git a/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php b/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
index 4cf4e73a67..262bc20e53 100644
--- a/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
+++ b/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
@@ -105,10 +105,7 @@ class AccessChecker implements AccessEntityCREDChecker
         else if ($this->aclManager->checkEntity($user, $parent)) {
             if (
                 $entity->getTargetField() &&
-                in_array(
-                    $entity->getTargetField(),
-                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
-                )
+                !$this->aclManager->checkField($user, $parent->getEntityType(), $entity->getTargetField())
             ) {
                 return false;
             }
diff --git a/application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php b/application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php
index 01c7524be2..eda4cffbd3 100644
--- a/application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php
+++ b/application/Espo/Classes/FieldProcessing/User/LastAccessLoader.php
@@ -34,7 +34,6 @@ use Espo\Entities\AuthToken;
 use Espo\Entities\User;
 use Espo\ORM\Entity;
 use Espo\Core\Acl;
-use Espo\Core\Acl\Table;
 use Espo\Core\FieldProcessing\Loader;
 use Espo\Core\FieldProcessing\Loader\Params;
 use Espo\Core\ORM\EntityManager;
@@ -44,6 +43,7 @@ use Exception;
 
 /**
  * @implements Loader<User>
+ * @noinspection PhpUnused
  */
 class LastAccessLoader implements Loader
 {
@@ -58,10 +58,7 @@ class LastAccessLoader implements Loader
 
     public function process(Entity $entity, Params $params): void
     {
-        $forbiddenFieldList = $this->acl
-            ->getScopeForbiddenFieldList($entity->getEntityType(), Table::ACTION_READ);
-
-        if (in_array('lastAccess', $forbiddenFieldList)) {
+        if (!$this->acl->checkField($entity->getEntityType(), 'lastAccess')) {
             return;
         }
 
diff --git a/application/Espo/Core/Record/Service.php b/application/Espo/Core/Record/Service.php
index 8a47c363f9..57b2649c7e 100644
--- a/application/Espo/Core/Record/Service.php
+++ b/application/Espo/Core/Record/Service.php
@@ -43,6 +43,7 @@ use Espo\Core\Exceptions\NotFoundSilent;
 use Espo\Core\FieldSanitize\SanitizeManager;
 use Espo\Core\ORM\Entity as CoreEntity;
 use Espo\Core\ORM\Repository\Option\SaveOption;
+use Espo\Core\ORM\Type\FieldType;
 use Espo\Core\Record\Access\LinkCheck;
 use Espo\Core\Record\ActionHistory\Action;
 use Espo\Core\Record\ActionHistory\ActionLogger;
@@ -653,57 +654,45 @@ class Service implements Crud,
     public function populateDefaults(Entity $entity, stdClass $data): void
     {
         if (!$this->user->isPortal()) {
-            $forbiddenFieldList = null;
-
-            if ($entity->hasAttribute('assignedUserId')) {
-                $forbiddenFieldList = $this->acl
-                    ->getScopeForbiddenFieldList($this->entityType, AclTable::ACTION_EDIT);
-
-                if (in_array('assignedUser', $forbiddenFieldList)) {
-                    $entity->set('assignedUserId', $this->user->getId());
-                    $entity->set('assignedUserName', $this->user->getName());
-                }
+            if (
+                $entity->hasAttribute('assignedUserId') &&
+                !$this->acl->checkField($this->entityType, 'assignedUser', AclTable::ACTION_EDIT)
+            ) {
+                $entity->set('assignedUserId', $this->user->getId());
+                $entity->set('assignedUserName', $this->user->getName());
             }
 
             if (
                 $entity instanceof CoreEntity &&
-                $entity->hasLinkMultipleField('teams')
+                $entity->hasLinkMultipleField('teams') &&
+                $this->user->getDefaultTeam() &&
+                !$this->acl->checkField($this->entityType, 'teams', AclTable::ACTION_EDIT)
             ) {
-                if (is_null($forbiddenFieldList)) {
-                    $forbiddenFieldList = $this->acl
-                        ->getScopeForbiddenFieldList($this->entityType, AclTable::ACTION_EDIT);
+                $defaultTeamId = $this->user->getDefaultTeam()->getId();
+
+                $entity->addLinkMultipleId('teams', $defaultTeamId);
+
+                $teamsNames = $entity->get('teamsNames');
+
+                if (!$teamsNames || !is_object($teamsNames)) {
+                    $teamsNames = (object) [];
                 }
 
-                if (
-                    in_array('teams', $forbiddenFieldList) &&
-                    $this->user->get('defaultTeamId')
-                ) {
+                $teamsNames->$defaultTeamId = $this->user->get('defaultTeamName');
 
-                    $defaultTeamId = $this->user->get('defaultTeamId');
-
-                    $entity->addLinkMultipleId('teams', $defaultTeamId);
-
-                    $teamsNames = $entity->get('teamsNames');
-
-                    if (!$teamsNames || !is_object($teamsNames)) {
-                        $teamsNames = (object) [];
-                    }
-
-                    $teamsNames->$defaultTeamId = $this->user->get('defaultTeamName');
-
-                    $entity->set('teamsNames', $teamsNames);
-
-                }
+                $entity->set('teamsNames', $teamsNames);
             }
         }
 
         foreach ($this->fieldUtil->getEntityTypeFieldList($this->entityType) as $field) {
             $type = $this->fieldUtil->getEntityTypeFieldParam($this->entityType, $field, 'type');
 
-            if ($type === 'currency') {
-                if ($entity->get($field) && !$entity->get($field . 'Currency')) {
-                    $entity->set($field . 'Currency', $this->config->get('defaultCurrency'));
-                }
+            if (
+                $type === FieldType::CURRENCY &&
+                $entity->get($field) &&
+                !$entity->get($field . 'Currency')
+            ) {
+                $entity->set($field . 'Currency', $this->config->get('defaultCurrency'));
             }
         }
     }
diff --git a/application/Espo/Core/Select/Where/Checker.php b/application/Espo/Core/Select/Where/Checker.php
index c173831673..8e5e78cf91 100644
--- a/application/Espo/Core/Select/Where/Checker.php
+++ b/application/Espo/Core/Select/Where/Checker.php
@@ -168,7 +168,7 @@ class Checker
         $entityType = $this->entityType;
 
         if (str_contains($attribute, '.')) {
-            list($link, $attribute) = explode('.', $attribute);
+            [$link, $attribute] = explode('.', $attribute);
 
             if (!$this->getSeed()->hasRelation($link)) {
                 // TODO allow alias
diff --git a/application/Espo/Core/Webhook/Queue.php b/application/Espo/Core/Webhook/Queue.php
index 1912d90973..2981febbb4 100644
--- a/application/Espo/Core/Webhook/Queue.php
+++ b/application/Espo/Core/Webhook/Queue.php
@@ -172,6 +172,7 @@ class Queue
             ->limit(0, $batchSize)
             ->find();
 
+        /** @var ?Webhook $webhook */
         $webhook = $this->entityManager->getEntityById(Webhook::ENTITY_TYPE, $webhookId);
 
         if (!$webhook || !$webhook->get('isActive')) {
@@ -187,6 +188,7 @@ class Queue
         $user = null;
 
         if ($webhook->get('userId')) {
+            /** @var ?User $user */
             $user = $this->entityManager->getEntity(User::ENTITY_TYPE, $webhook->get('userId'));
 
             if (!$user) {
diff --git a/application/Espo/Modules/Crm/Tools/Case/Service.php b/application/Espo/Modules/Crm/Tools/Case/Service.php
index d655cb8e25..14173d6fe6 100644
--- a/application/Espo/Modules/Crm/Tools/Case/Service.php
+++ b/application/Espo/Modules/Crm/Tools/Case/Service.php
@@ -210,10 +210,8 @@ class Service
             return [];
         }
 
-        $contactForbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Contact::ENTITY_TYPE);
-
-        if (in_array('emailAddress', $contactForbiddenFieldList)) {
-            return [];
+        if (!$this->acl->checkField(Contact::ENTITY_TYPE, 'emailAddress')) {
+            return[];
         }
 
         $dataList = [];
diff --git a/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByLeadSource.php b/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByLeadSource.php
index 20ea73dc01..61187382ff 100644
--- a/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByLeadSource.php
+++ b/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByLeadSource.php
@@ -30,6 +30,7 @@
 namespace Espo\Modules\Crm\Tools\Opportunity\Report;
 
 use Espo\Core\Acl;
+use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Select\SelectBuilderFactory;
 use Espo\Core\Utils\Config;
@@ -38,32 +39,19 @@ use Espo\Modules\Crm\Entities\Opportunity;
 use Espo\ORM\EntityManager;
 use Espo\ORM\Query\Part\Expression;
 use Espo\ORM\Query\Part\Order;
+use RuntimeException;
 use stdClass;
 
 class ByLeadSource
 {
-    private Acl $acl;
-    private Config $config;
-    private Metadata $metadata;
-    private EntityManager $entityManager;
-    private SelectBuilderFactory $selectBuilderFactory;
-    private Util $util;
-
     public function __construct(
-        Acl $acl,
-        Config $config,
-        Metadata $metadata,
-        EntityManager $entityManager,
-        SelectBuilderFactory $selectBuilderFactory,
-        Util $util
-    ) {
-        $this->acl = $acl;
-        $this->config = $config;
-        $this->metadata = $metadata;
-        $this->entityManager = $entityManager;
-        $this->selectBuilderFactory = $selectBuilderFactory;
-        $this->util = $util;
-    }
+        private Acl $acl,
+        private Config $config,
+        private Metadata $metadata,
+        private EntityManager $entityManager,
+        private SelectBuilderFactory $selectBuilderFactory,
+        private Util $util
+    ) {}
 
     /**
      * @throws Forbidden
@@ -78,19 +66,24 @@ class ByLeadSource
             throw new Forbidden();
         }
 
-        if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
-            throw new Forbidden();
+        if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
+            throw new Forbidden("No access to 'amount' field.");
         }
 
         [$from, $to] = $range->getRange();
 
         $options = $this->metadata->get('entityDefs.Lead.fields.source.options', []);
 
-        $queryBuilder = $this->selectBuilderFactory
-            ->create()
-            ->from(Opportunity::ENTITY_TYPE)
-            ->withStrictAccessControl()
-            ->buildQueryBuilder();
+        try {
+            $queryBuilder = $this->selectBuilderFactory
+                ->create()
+                ->from(Opportunity::ENTITY_TYPE)
+                ->withStrictAccessControl()
+                ->buildQueryBuilder();
+        }
+        catch (BadRequest|Forbidden $e) {
+            throw new RuntimeException($e->getMessage());
+        }
 
         $whereClause = [
             ['stage!=' => $this->util->getLostStageList()],
diff --git a/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByStage.php b/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByStage.php
index 713a5c820f..2f6e4b1c97 100644
--- a/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByStage.php
+++ b/application/Espo/Modules/Crm/Tools/Opportunity/Report/ByStage.php
@@ -78,8 +78,8 @@ class ByStage
             throw new Forbidden();
         }
 
-        if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
-            throw new Forbidden();
+        if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
+            throw new Forbidden("No access to 'amount' field.");
         }
 
         [$from, $to] = $range->getRange();
diff --git a/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesByMonth.php b/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesByMonth.php
index 92ddaec108..c7ff52a8f8 100644
--- a/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesByMonth.php
+++ b/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesByMonth.php
@@ -43,25 +43,13 @@ use stdClass;
 
 class SalesByMonth
 {
-    private Acl $acl;
-    private Config $config;
-    private EntityManager $entityManager;
-    private SelectBuilderFactory $selectBuilderFactory;
-    private Util $util;
-
     public function __construct(
-        Acl $acl,
-        Config $config,
-        EntityManager $entityManager,
-        SelectBuilderFactory $selectBuilderFactory,
-        Util $util
-    ) {
-        $this->acl = $acl;
-        $this->config = $config;
-        $this->entityManager = $entityManager;
-        $this->selectBuilderFactory = $selectBuilderFactory;
-        $this->util = $util;
-    }
+        private Acl $acl,
+        private Config $config,
+        private EntityManager $entityManager,
+        private SelectBuilderFactory $selectBuilderFactory,
+        private Util $util
+    ) {}
 
     /**
      * @throws Forbidden
@@ -76,8 +64,8 @@ class SalesByMonth
             throw new Forbidden();
         }
 
-        if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
-            throw new Forbidden();
+        if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
+            throw new Forbidden("No access to 'amount' field.");
         }
 
         [$from, $to] = $range->getRange();
diff --git a/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesPipeline.php b/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesPipeline.php
index fdc8ee937d..32c25fd3d2 100644
--- a/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesPipeline.php
+++ b/application/Espo/Modules/Crm/Tools/Opportunity/Report/SalesPipeline.php
@@ -42,28 +42,14 @@ use stdClass;
 
 class SalesPipeline
 {
-    private Acl $acl;
-    private Config $config;
-    private Metadata $metadata;
-    private EntityManager $entityManager;
-    private SelectBuilderFactory $selectBuilderFactory;
-    private Util $util;
-
     public function __construct(
-        Acl $acl,
-        Config $config,
-        Metadata $metadata,
-        EntityManager $entityManager,
-        SelectBuilderFactory $selectBuilderFactory,
-        Util $util
-    ) {
-        $this->acl = $acl;
-        $this->config = $config;
-        $this->metadata = $metadata;
-        $this->entityManager = $entityManager;
-        $this->selectBuilderFactory = $selectBuilderFactory;
-        $this->util = $util;
-    }
+        private Acl $acl,
+        private Config $config,
+        private Metadata $metadata,
+        private EntityManager $entityManager,
+        private SelectBuilderFactory $selectBuilderFactory,
+        private Util $util
+    ) {}
 
     /**
      * @throws Forbidden
@@ -78,8 +64,8 @@ class SalesPipeline
             throw new Forbidden();
         }
 
-        if (in_array('amount', $this->acl->getScopeForbiddenAttributeList(Opportunity::ENTITY_TYPE))) {
-            throw new Forbidden();
+        if (!$this->acl->checkField(Opportunity::ENTITY_TYPE, 'amount')) {
+            throw new Forbidden("No access to 'amount' field.");
         }
 
         [$from, $to] = $range->getRange();
diff --git a/application/Espo/Modules/Crm/Tools/Opportunity/Service.php b/application/Espo/Modules/Crm/Tools/Opportunity/Service.php
index ed1b6b3d5f..785f0cf23c 100644
--- a/application/Espo/Modules/Crm/Tools/Opportunity/Service.php
+++ b/application/Espo/Modules/Crm/Tools/Opportunity/Service.php
@@ -30,7 +30,8 @@
 namespace Espo\Modules\Crm\Tools\Opportunity;
 
 use Espo\Core\Acl;
-use Espo\Core\Exceptions\ForbiddenSilent;
+use Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Field\EmailAddress;
 use Espo\Core\Record\ServiceContainer;
 use Espo\Core\Select\SelectBuilderFactory;
@@ -40,29 +41,21 @@ use Espo\Modules\Crm\Entities\Opportunity;
 use Espo\ORM\Collection;
 use Espo\ORM\EntityManager;
 use Espo\Tools\Email\EmailAddressEntityPair;
+use RuntimeException;
 
 class Service
 {
-    private ServiceContainer $serviceContainer;
-    private Acl $acl;
-    private EntityManager $entityManager;
-    private SelectBuilderFactory $selectBuilderFactory;
 
     public function __construct(
-        ServiceContainer $serviceContainer,
-        Acl $acl,
-        EntityManager $entityManager,
-        SelectBuilderFactory $selectBuilderFactory
-    ) {
-        $this->serviceContainer = $serviceContainer;
-        $this->acl = $acl;
-        $this->entityManager = $entityManager;
-        $this->selectBuilderFactory = $selectBuilderFactory;
-    }
+        private ServiceContainer $serviceContainer,
+        private Acl $acl,
+        private EntityManager $entityManager,
+        private SelectBuilderFactory $selectBuilderFactory
+    ) {}
 
     /**
-     * @throws ForbiddenSilent
      * @return EmailAddressEntityPair[]
+     * @throws Forbidden
      */
     public function getEmailAddressList(string $id): array
     {
@@ -71,12 +64,10 @@ class Service
             ->get(Opportunity::ENTITY_TYPE)
             ->getEntity($id);
 
-        $forbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Opportunity::ENTITY_TYPE);
-
         $list = [];
 
         if (
-            !in_array('contacts', $forbiddenFieldList) &&
+            $this->acl->checkField(Opportunity::ENTITY_TYPE, 'contacts') &&
             $this->acl->checkScope(Contact::ENTITY_TYPE)
         ) {
             foreach ($this->getContactEmailAddressList($entity) as $item) {
@@ -86,7 +77,7 @@ class Service
 
         if (
             $list === [] &&
-            !in_array('account', $forbiddenFieldList) &&
+            $this->acl->checkField(Opportunity::ENTITY_TYPE, 'account') &&
             $this->acl->checkScope(Account::ENTITY_TYPE)
         ) {
             $item = $this->getAccountEmailAddress($entity, $list);
@@ -149,9 +140,7 @@ class Service
             return [];
         }
 
-        $contactForbiddenFieldList = $this->acl->getScopeForbiddenFieldList(Contact::ENTITY_TYPE);
-
-        if (in_array('emailAddress', $contactForbiddenFieldList)) {
+        if (!$this->acl->checkField(Contact::ENTITY_TYPE, 'emailAddress')) {
             return [];
         }
 
@@ -159,20 +148,25 @@ class Service
 
         $emailAddressList = [];
 
-        $query = $this->selectBuilderFactory
-            ->create()
-            ->from(Contact::ENTITY_TYPE)
-            ->withStrictAccessControl()
-            ->buildQueryBuilder()
-            ->select([
-                'id',
-                'emailAddress',
-                'name',
-            ])
-            ->where([
-                'id' => $contactIdList,
-            ])
-            ->build();
+        try {
+            $query = $this->selectBuilderFactory
+                ->create()
+                ->from(Contact::ENTITY_TYPE)
+                ->withStrictAccessControl()
+                ->buildQueryBuilder()
+                ->select([
+                    'id',
+                    'emailAddress',
+                    'name',
+                ])
+                ->where([
+                    'id' => $contactIdList,
+                ])
+                ->build();
+        }
+        catch (BadRequest|Forbidden $e) {
+            throw new RuntimeException($e->getMessage());
+        }
 
         /** @var Collection<Contact> $contactCollection */
         $contactCollection = $this->entityManager
diff --git a/application/Espo/Services/Webhook.php b/application/Espo/Services/Webhook.php
index 1b28943dfe..877a46970f 100644
--- a/application/Espo/Services/Webhook.php
+++ b/application/Espo/Services/Webhook.php
@@ -33,7 +33,6 @@ use Espo\Entities\Webhook as WebhookEntity;
 use Espo\ORM\Entity;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Di;
-
 use Espo\Entities\User;
 
 use stdClass;
@@ -96,6 +95,9 @@ class Webhook extends Record implements
         parent::filterUpdateInput($data);
     }
 
+    /**
+     * @throws Forbidden
+     */
     protected function beforeCreateEntity(Entity $entity, $data)
     {
         $this->checkEntityUserIsApi($entity);
@@ -106,6 +108,9 @@ class Webhook extends Record implements
         }
     }
 
+    /**
+     * @throws Forbidden
+     */
     protected function checkMaxCount(): void
     {
         $maxCount = $this->config->get('webhookMaxCountPerUser', self::WEBHOOK_MAX_COUNT_PER_USER);
@@ -122,12 +127,18 @@ class Webhook extends Record implements
         }
     }
 
+    /**
+     * @throws Forbidden
+     */
     protected function beforeUpdateEntity(Entity $entity, $data)
     {
         $this->checkEntityUserIsApi($entity);
         $this->processEntityEventData($entity);
     }
 
+    /**
+     * @throws Forbidden
+     */
     protected function checkEntityUserIsApi(Entity $entity): void
     {
         $userId = $entity->get('userId');
@@ -144,6 +155,9 @@ class Webhook extends Record implements
         }
     }
 
+    /**
+     * @throws Forbidden
+     */
     protected function processEntityEventData(Entity $entity): void
     {
         $event = $entity->get('event');
@@ -164,7 +178,6 @@ class Webhook extends Record implements
             throw new Forbidden("Not supported event.");
         }
 
-        $arr = explode('.', $event);
         $entityType = $arr[0];
         $type = $arr[1];
 
@@ -204,9 +217,7 @@ class Webhook extends Record implements
                 throw new Forbidden("Field is empty.");
             }
 
-            $forbiddenFieldList = $this->getAcl()->getScopeForbiddenFieldList($entityType);
-
-            if (in_array($field, $forbiddenFieldList)) {
+            if (!$this->acl->checkField($entityType, $field)) {
                 throw new Forbidden("Field is forbidden.");
             }
 
@@ -214,6 +225,7 @@ class Webhook extends Record implements
                 throw new Forbidden("Field does not exist.");
             }
         } else {
+            /** @noinspection PhpRedundantOptionalArgumentInspection */
             $entity->set('field', null);
         }
     }
diff --git a/application/Espo/Tools/App/AppService.php b/application/Espo/Tools/App/AppService.php
index 2538d0b9e0..906874f73c 100644
--- a/application/Espo/Tools/App/AppService.php
+++ b/application/Espo/Tools/App/AppService.php
@@ -193,7 +193,7 @@ class AppService
         unset($data->authTokenId);
         unset($data->password);
 
-        $forbiddenAttributeList = $this->acl->getScopeForbiddenAttributeList('User');
+        $forbiddenAttributeList = $this->acl->getScopeForbiddenAttributeList(User::ENTITY_TYPE);
 
         $isPortal = $user->isPortal();
 
diff --git a/application/Espo/Tools/Attachment/AccessChecker.php b/application/Espo/Tools/Attachment/AccessChecker.php
index 82b61361a4..dba4282bf2 100644
--- a/application/Espo/Tools/Attachment/AccessChecker.php
+++ b/application/Espo/Tools/Attachment/AccessChecker.php
@@ -60,19 +60,11 @@ class AccessChecker
         Attachment::ROLE_INLINE_ATTACHMENT,
     ];
 
-    private User $user;
-    private Acl $acl;
-    private Metadata $metadata;
-
     public function __construct(
-        User $user,
-        Acl $acl,
-        Metadata $metadata
-    ) {
-        $this->user = $user;
-        $this->acl = $acl;
-        $this->metadata = $metadata;
-    }
+        private User $user,
+        private Acl $acl,
+        private Metadata $metadata
+    ) {}
 
     /**
      * Check access to a field and role allowance.
@@ -103,7 +95,7 @@ class AccessChecker
         $fieldType = $this->metadata->get(['entityDefs', $relatedEntityType, 'fields', $field, 'type']);
 
         if (!$fieldType) {
-            throw new Forbidden("Field '{$field}' does not exist.");
+            throw new Forbidden("Field '$field' does not exist.");
         }
 
         $fieldTypeList = $role === Attachment::ROLE_INLINE_ATTACHMENT ?
@@ -111,7 +103,7 @@ class AccessChecker
             $this->attachmentFieldTypeList;
 
         if (!in_array($fieldType, $fieldTypeList)) {
-            throw new Forbidden("Field type '{$fieldType}' is not allowed for {$role}.");
+            throw new Forbidden("Field type '$fieldType' is not allowed for $role.");
         }
 
         if ($this->user->isAdmin() && $relatedEntityType === Settings::ENTITY_TYPE) {
@@ -125,8 +117,8 @@ class AccessChecker
             throw new Forbidden("No access to " . $relatedEntityType . ".");
         }
 
-        if (in_array($field, $this->acl->getScopeForbiddenFieldList($relatedEntityType, Table::ACTION_EDIT))) {
-            throw new Forbidden("No access to field '" . $field . "'.");
+        if (!$this->acl->checkField($relatedEntityType, $field, Table::ACTION_EDIT)) {
+            throw new Forbidden("No access to field '$field'.");
         }
     }
 }
diff --git a/application/Espo/Tools/DataPrivacy/Erasor.php b/application/Espo/Tools/DataPrivacy/Erasor.php
index 61511df4f4..ba24437ac8 100644
--- a/application/Espo/Tools/DataPrivacy/Erasor.php
+++ b/application/Espo/Tools/DataPrivacy/Erasor.php
@@ -89,7 +89,7 @@ class Erasor implements
 
         foreach ($fieldList as $field) {
             if (in_array($field, $forbiddenFieldList)) {
-                throw new Forbidden("Field '{$field}' is forbidden to edit.");
+                throw new Forbidden("Field '$field' is forbidden to edit.");
             }
         }
 
diff --git a/application/Espo/Tools/Email/InboxService.php b/application/Espo/Tools/Email/InboxService.php
index cf4a3e7cf5..419a391a08 100644
--- a/application/Espo/Tools/Email/InboxService.php
+++ b/application/Espo/Tools/Email/InboxService.php
@@ -109,17 +109,12 @@ class InboxService
                 throw new Forbidden("No access to current group folder.");
             }
 
-            if (
-                in_array(
-                    'groupFolder',
-                    $this->aclManager->getScopeForbiddenFieldList($user, Email::ENTITY_TYPE, Table::ACTION_EDIT)
-                )
-            ) {
+            if (!$this->aclManager->checkField($user, Email::ENTITY_TYPE, 'groupFolder', Table::ACTION_EDIT)) {
                 throw new Forbidden("No access to `groupFolder` field.");
             }
         }
 
-        if ($folderId && strpos($folderId, 'group:') === 0) {
+        if ($folderId && str_starts_with($folderId, 'group:')) {
             try {
                 $this->moveToGroupFolder($email, substr($folderId, 6), $user);
             }
@@ -180,12 +175,7 @@ class InboxService
             throw new Forbidden("No read access to email to unset group folder.");
         }
 
-        if (
-            in_array(
-                'groupFolder',
-                $this->aclManager->getScopeForbiddenFieldList($user, Email::ENTITY_TYPE, Table::ACTION_EDIT)
-            )
-        ) {
+        if (!$this->aclManager->checkField($user, Email::ENTITY_TYPE, 'groupFolder', Table::ACTION_EDIT)) {
             throw new Forbidden("No access to `groupFolder` field.");
         }