Access Control Prompts Without Payloads