diff --git a/application/Espo/Core/Console/Commands/AclCheck.php b/application/Espo/Core/Console/Commands/AclCheck.php
new file mode 100644
index 0000000000..1512976f91
--- /dev/null
+++ b/application/Espo/Core/Console/Commands/AclCheck.php
@@ -0,0 +1,80 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2018 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Console\Commands;
+
+class AclCheck extends Base
+{
+    public function run()
+    {
+        $userId = isset($_SERVER['argv'][2]) ? trim($_SERVER['argv'][2]) : null;
+        if (empty($userId)) return;
+
+        $scope = isset($_SERVER['argv'][3]) ? trim($_SERVER['argv'][3]) : null;
+        if (empty($scope)) return;
+
+        $id = isset($_SERVER['argv'][4]) ? trim($_SERVER['argv'][4]) : null;
+        if (empty($id)) return;
+
+        $action = isset($_SERVER['argv'][5]) ? trim($_SERVER['argv'][5]) : null;
+
+        $portalId = isset($_SERVER['argv'][6]) ? trim($_SERVER['argv'][6]) : null;
+
+        $container = $this->getContainer();
+
+        if ($portalId) {
+            $application = new \Espo\Core\Portal\Application($portalId);
+            $container = $application->getContainer();
+        }
+
+        $entityManager = $container->get('entityManager');
+
+        $user = $entityManager->getEntity('User', $userId);
+        if (!$user) return;
+
+        if ($portalId) {
+            if (
+                !$user->isPortal()
+                ||
+                !in_array($portalId, $user->getLinkMultipleIdList('portals'))
+            ) {
+                return;
+            }
+        }
+
+        $entity = $entityManager->getEntity($scope, $id);
+        if (!$entity) return;
+
+        $aclManager = $container->get('aclManager');
+
+        if ($aclManager->check($user, $entity, $action)) {
+            return 'true';
+        }
+    }
+}
diff --git a/application/Espo/Core/WebSocket/Pusher.php b/application/Espo/Core/WebSocket/Pusher.php
index c24d94b817..3f170a9257 100644
--- a/application/Espo/Core/WebSocket/Pusher.php
+++ b/application/Espo/Core/WebSocket/Pusher.php
@@ -36,6 +36,8 @@ class Pusher implements WampServerInterface
 {
     private $categoryList;
 
+    protected $categoriesData;
+
     protected $isDebugMode = false;
 
     protected $connectionIdUserIdMap = [];
@@ -48,9 +50,11 @@ class Pusher implements WampServerInterface
 
     private $phpExecutablePath;
 
-    public function __construct(array $categoryList = [], $phpExecutablePath = null, $isDebugMode = false)
+    public function __construct(array $categoriesData = [], $phpExecutablePath = null, $isDebugMode = false)
     {
-        $this->categoryList = $categoryList;
+        $this->categoryList = array_keys($categoriesData);
+        $this->categoriesData = $categoriesData;
+
         $this->phpExecutablePath = $phpExecutablePath ?: (new \Symfony\Component\Process\PhpExecutableFinder)->find();
         $this->isDebugMode = $isDebugMode;
     }
@@ -60,7 +64,7 @@ class Pusher implements WampServerInterface
         $topicId = $topic->getId();
         if (!$topicId) return;
 
-        if (!$this->isCategoryAllowed($topicId)) return;
+        if (!$this->isTopicAllowed($topicId)) return;
 
         $connectionId = $connection->resourceId;
 
@@ -69,6 +73,14 @@ class Pusher implements WampServerInterface
 
         if (!isset($this->connectionIdTopicIdListMap[$connectionId])) $this->connectionIdTopicIdListMap[$connectionId] = [];
 
+        $checkCommand = $this->getAccessCheckCommandForTopic($connection, $topic);
+        if ($checkCommand) {
+            $checkResult = shell_exec($checkCommand);
+            if ($checkResult !== 'true') {
+                return;
+            }
+        }
+
         if (!in_array($topicId, $this->connectionIdTopicIdListMap[$connectionId])) {
             if ($this->isDebugMode) echo "add topic {$topicId} for user {$userId}\n";
             $this->connectionIdTopicIdListMap[$connectionId][] = $topicId;
@@ -80,7 +92,7 @@ class Pusher implements WampServerInterface
         $topicId = $topic->getId();
         if (!$topicId) return;
 
-        if (!$this->isCategoryAllowed($topicId)) return;
+        if (!$this->isTopicAllowed($topicId)) return;
 
         $connectionId = $connection->resourceId;
 
@@ -96,8 +108,55 @@ class Pusher implements WampServerInterface
         }
     }
 
-    protected function isCategoryAllowed($category)
+    protected function getParamsFromTopicId(string $topicId) : array
     {
+        $arr = explode('.', $topicId);
+        $category = $arr[0];
+
+        $params = [];
+
+        if (array_key_exists('paramList', $this->categoriesData[$category])) {
+            foreach ($this->categoriesData[$category]['paramList'] as $i => $item) {
+                if (isset($arr[$i + 1])) {
+                    $params[$item] = $arr[$i + 1];
+                }
+            }
+        }
+
+        return $params;
+    }
+
+    protected function getAccessCheckCommandForTopic(ConnectionInterface $connection, $topic) : ?string
+    {
+        $topicId = $topic->getId();
+
+        $params = $this->getParamsFromTopicId($topicId);
+        $params['userId'] = $this->getUserIdByConnection($connection);
+        if (!$params['userId']) {
+            $connection->close();
+            return null;
+        }
+
+        $category = $this->getTopicCategory($topic);
+        if (!array_key_exists('accessCheckCommand', $this->categoriesData[$category])) return null;
+
+        $command = $this->phpExecutablePath . " command.php " . $this->categoriesData[$category]['accessCheckCommand'];
+        foreach ($params as $key => $value) {
+            str_replace(':' . $key, $value, $command);
+        }
+
+        return $command;
+    }
+
+    protected function getTopicCategory($topic)
+    {
+        list($category) = explode('.', $topic->getId());
+        return $category;
+    }
+
+    protected function isTopicAllowed($topicId)
+    {
+        list($category) = explode('.', $topicId);
         return in_array($category, $this->categoryList);
     }
 
diff --git a/application/Espo/Resources/metadata/app/webSocket.json b/application/Espo/Resources/metadata/app/webSocket.json
index 7f81831aec..0abe89ee01 100644
--- a/application/Espo/Resources/metadata/app/webSocket.json
+++ b/application/Espo/Resources/metadata/app/webSocket.json
@@ -1,5 +1,9 @@
 {
     "categories": {
-        "newNotification": {}
+        "newNotification": {},
+        "streamUpdate": {
+            "paramList": ["scope", "id", "portalId"],
+            "accessCheckCommand": "AclCheck :userId :scope :id stream :portalId"
+        }
     }
 }
diff --git a/websocket.php b/websocket.php
index 60fa22e85f..8bf656eb8f 100644
--- a/websocket.php
+++ b/websocket.php
@@ -33,11 +33,12 @@ include "bootstrap.php";
 
 $app = new \Espo\Core\Application();
 
-$categoryList = array_keys($app->getContainer()->get('metadata')->get(['app', 'webSocket', 'categories'], []));
+$categoriesData = $app->getContainer()->get('metadata')->get(['app', 'webSocket', 'categories'], []);
+
 $phpExecutablePath = $app->getContainer()->get('config')->get('phpExecutablePath');
 
 $loop = \React\EventLoop\Factory::create();
-$pusher = new \Espo\Core\WebSocket\Pusher($categoryList, $phpExecutablePath);
+$pusher = new \Espo\Core\WebSocket\Pusher($categoriesData, $phpExecutablePath);
 
 $context = new \React\ZMQ\Context($loop);
 $pull = $context->getSocket(\ZMQ::SOCKET_PULL);