Adding access validation on hook_entity_operation