diff --git a/.gitignore b/.gitignore
index 4a21ece..ecb3f3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -130,4 +130,5 @@ dist
 .pnp.*
 
 bundle/
-lib/
\ No newline at end of file
+lib/
+.DS_Store
diff --git a/src/sdk/config.ts b/src/sdk/config.ts
index 7247305..23428b7 100644
--- a/src/sdk/config.ts
+++ b/src/sdk/config.ts
@@ -81,11 +81,11 @@ export const getPublicParams = async (config: FhevmInstanceConfig) => {
   }
 };
 
-export const getKMSSignatures = async (
+export const getKMSSigners = async (
   provider: Provider,
   config: FhevmInstanceConfig,
 ): Promise<string[]> => {
   const kmsContract = new Contract(config.kmsContractAddress, abi, provider);
-  const signatures: string[] = await kmsContract.getSigners();
-  return signatures;
+  const signers: string[] = await kmsContract.getSigners();
+  return signers;
 };
diff --git a/src/sdk/index.ts b/src/sdk/index.ts
index 13c3f2a..d853d26 100644
--- a/src/sdk/index.ts
+++ b/src/sdk/index.ts
@@ -1,7 +1,7 @@
 import {
   FhevmInstanceConfig,
   getChainId,
-  getKMSSignatures,
+  getKMSSigners,
   getProvider,
   getPublicParams,
   getTfheCompactPublicKey,
@@ -11,7 +11,7 @@ import { PublicParams, ZKInput } from './encrypt';
 import { createEncryptedInput } from './encrypt';
 import { generateKeypair, createEIP712, EIP712 } from './keypair';
 import { reencryptRequest } from './reencrypt';
-import { isAddress } from 'ethers';
+import { isAddress, ethers } from 'ethers';
 
 export type FhevmInstance = {
   createEncryptedInput: (
@@ -66,7 +66,7 @@ export const createInstance = async (
 
   const pkePublicParams: PublicParams = await getPublicParams(config);
 
-  const kmsSignatures = await getKMSSignatures(provider, config);
+  const kmsSigners = await getKMSSigners(provider, config);
 
   return {
     createEncryptedInput: createEncryptedInput(
@@ -79,10 +79,12 @@ export const createInstance = async (
     generateKeypair,
     createEIP712: createEIP712(chainId),
     reencrypt: reencryptRequest(
-      kmsSignatures,
+      kmsSigners,
       chainId,
       kmsContractAddress,
+      aclContractAddress,
       cleanURL(config.gatewayUrl),
+      provider,
     ),
     getPublicKey: () => publicKey || null,
     getPublicParams: () => pkePublicParams || null,
diff --git a/src/sdk/reencrypt.test.ts b/src/sdk/reencrypt.test.ts
index 2858795..240b875 100644
--- a/src/sdk/reencrypt.test.ts
+++ b/src/sdk/reencrypt.test.ts
@@ -1,5 +1,6 @@
 import { reencryptRequest } from './reencrypt';
 import fetchMock from '@fetch-mock/core';
+import { ethers } from 'ethers';
 
 fetchMock.mockGlobal();
 
@@ -21,7 +22,9 @@ describe('reencrypt', () => {
       [],
       9000,
       '0x8ba1f109551bd432803012645ac136ddd64dba72',
+      '0xa5e1defb98EFe38EBb2D958CEe052410247F4c80',
       'https://test-gateway.net/',
+      new ethers.JsonRpcProvider('https://devnet.zama.ai'),
     );
     // const result = await reencrypt(
     //   BigInt(3333),
diff --git a/src/sdk/reencrypt.ts b/src/sdk/reencrypt.ts
index 31c0f8a..cd4084f 100644
--- a/src/sdk/reencrypt.ts
+++ b/src/sdk/reencrypt.ts
@@ -1,23 +1,24 @@
-import { Provider } from 'ethers';
-import {
-  bytesToBigInt,
-  bigIntToBytes256,
-  toHexString,
-  fromHexString,
-} from '../utils';
+import { bytesToBigInt, fromHexString } from '../utils';
 import {
   u8vec_to_cryptobox_pk,
   new_client,
   process_reencryption_resp_from_js,
   u8vec_to_cryptobox_sk,
 } from 'node-tkms';
+import { ethers } from 'ethers';
+
+const aclABI = [
+  'function persistAllowed(uint256 handle, address account) view returns (bool)',
+];
 
 export const reencryptRequest =
   (
     kmsSignatures: string[],
     chainId: number,
     kmsContractAddress: string,
+    aclContractAddress: string,
     gatewayUrl: string,
+    provider: ethers.JsonRpcProvider | ethers.BrowserProvider,
   ) =>
   async (
     handle: bigint,
@@ -27,6 +28,18 @@ export const reencryptRequest =
     contractAddress: string,
     userAddress: string,
   ) => {
+    const acl = new ethers.Contract(aclContractAddress, aclABI, provider);
+    const userAllowed = await acl.persistAllowed(handle, userAddress);
+    const contractAllowed = await acl.persistAllowed(handle, contractAddress);
+    const isAllowed = userAllowed && contractAllowed;
+    if (!isAllowed) {
+      throw new Error('User is not authorized to reencrypt this handle!');
+    }
+    if (userAddress === contractAddress) {
+      throw new Error(
+        'userAddress should not be equal to contractAddress when requesting reencryption!',
+      );
+    }
     const payload = {
       signature: signature.replace(/^(0x)/, ''),
       user_address: userAddress.replace(/^(0x)/, ''),