# Access control via DAO (with timelock controller) proposal

**URL:** <https://forum.openzeppelin.com/t/access-control-via-dao-with-timelock-controller-proposal/34698>\
**Category:** Smart Contracts\
**Created:** [February 13, 2023, 12:08am UTC](https://forum.openzeppelin.com/t/access-control-via-dao-with-timelock-controller-proposal/34698 "2023-02-13T00:08:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pcpLiu](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/pcpliu/32/14259_2.png) [@pcpLiu](https://forum.openzeppelin.com/u/pcpLiu)\
**Post date:** [February 13, 2023, 12:08am UTC](https://forum.openzeppelin.com/t/access-control-via-dao-with-timelock-controller-proposal/34698/1 "2023-02-13T00:08:53Z")

</div>

Hi,

I'm writing some DAO ecosys using `Governor ` with `GovernorTimelockControl ` extension.

In the [doc](https://docs.openzeppelin.com/contracts/4.x/governance#timelock), it says

> When using a timelock, it is the timelock that will execute proposals and thus the timelock that should hold any funds, ownership, and access control roles. Before version 4.5 there was no way to recover funds in the Governor contract when using a timelock! Before version 4.3, when using the Compound Timelock, ETH in the timelock was not easily accessible.

So after deployment, I have two contract addresses:

- `DAO` from deployment of Governor
- `TLC` from deployment of TimeLockController

If I have another contract whose function I only want DAO can access (through proposal execution), should I check `msg.sender` against `DAO` or `TLC`?

My understanding is `TLC` as it executes all proposals instead of DAO. But wanna get a confirmation here. Thanks

---

<div class="post-metadata">

**Author:** ![Skyge](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/skyge/32/343_2.png) [@Skyge](https://forum.openzeppelin.com/u/Skyge)\
**Post date:** [February 13, 2023, 12:21pm UTC](https://forum.openzeppelin.com/t/access-control-via-dao-with-timelock-controller-proposal/34698/2 "2023-02-13T12:21:18Z")

</div>

Yes, I think you should use the `TimeLockController` contract.

```auto
In a governance system, the `TimelockController` contract is in charge of introducing
a delay between a proposal and its execution. 

```