diff -r a42c276d42ba restws.entity.inc
--- a/restws.entity.inc	Mon Sep 30 22:35:25 2013 -0400
+++ b/restws.entity.inc	Wed Oct 02 04:34:29 2013 -0400
@@ -70,16 +70,12 @@
   public function delete($id);
 
   /**
-   * Determines access for a given operation and resource.
+   * Determines access for a given request.
    *
-   * @param string $op
-   *   Either 'create', 'view' (= read), 'update' or 'delete'.
-   * @param int|string $id
-   *   The id of the resource.
-   *
-   * @see entity_access()
+   * @param array $request
+   *   The request details.
    */
-  public function access($op, $id);
+  public function access(array $request);
 
   /**
    * Returns the name of the resource.
@@ -331,13 +327,55 @@
     }
   }
 
-  public function access($op, $id) {
-    return entity_access($op, $this->entityType, isset($id) ? $this->wrapper($id)->value() : NULL);
+  public function access(array $request) {
+    $op = $request['op'];
+    $id = $request['id'];
+
+    if (!empty($id)) {
+      $entity = $this->wrapper($id)->value();
+    } else if ($op == 'create') {
+      $entity = $this->createBlankEntityFromRequest($request);
+    } else {
+      $entity = NULL;
+    }
+    
+    return entity_access($op, $this->entityType, $entity);
   }
 
   public function resource() {
     return $this->entityType;
   }
+  
+  /**
+   * Creates a new blank entity object that, based on information decoded
+   * from the incoming request, should contain sufficient information for
+   * security checks and other logic to pass if the user has access to
+   * create that type of entity bundle.
+   * 
+   * @param array $request
+   *   The request info.
+   *   
+   * @return stdClass
+   *   A blank class object that may contain a 'type' field, if the incoming
+   *   request specified a type.
+   */
+  protected function createBlankEntityFromRequest(array $request) {
+    $entity = new stdClass();
+    
+    $resourceController = $request['resource'];
+    $payload            = $request['payload'];
+
+    if (!empty($resourceController) && !empty($payload)) {
+      $format = $request['format'];
+      $values = $format->unserialize($resourceController->propertyInfo(), $payload);
+      
+      if (isset($values['type'])) {
+        $entity->type = $values['type'];
+      }
+    }
+    
+    return $entity;
+  }
 
   /**
    * Helper function which takes care of distinguishing between fields and
diff -r a42c276d42ba restws.module
--- a/restws.module	Mon Sep 30 22:35:25 2013 -0400
+++ b/restws.module	Wed Oct 02 04:34:29 2013 -0400
@@ -129,7 +129,7 @@
     // Since there is no access callback for query we need to use view.
     $access_op = $op == 'query' ? 'view' : $op;
 
-    if (user_access('access resource ' . $resource_name) && $resource->access($access_op, $id)) {
+    if (user_access('access resource ' . $resource_name) && $resource->access($request)) {
       try {
         $method = $op . 'Resource';
         if ($op == 'create') {
@@ -523,13 +523,15 @@
         throw new EntityMalformedException('Permission to create a node was requested but no node type was given.');
       }
     }
-    // If a non-default revision is given, incorporate revision access.
-    $default_revision = node_load($node->nid);
-    if ($node->vid !== $default_revision->vid) {
-      return _node_revision_access($node, $op, $account);
-    }
-    else {
-      return node_access($op, $node, $account);
+    if (isset($node->nid)) {
+      // If a non-default revision is given, incorporate revision access.
+      $default_revision = node_load($node->nid);
+      if ($node->vid !== $default_revision->vid) {
+        return _node_revision_access($node, $op, $account);
+      }
+      else {
+        return node_access($op, $node, $account);
+      }
     }
   }
   // No node is provided. Check for access to all nodes.
@@ -539,7 +541,7 @@
   if (!user_access('access content', $account)) {
     return FALSE;
   }
-  if ($op == 'view' && node_access_view_all_nodes($account)) {
+  if (in_array($op, array('view', 'query')) && node_access_view_all_nodes($account)) {
     return TRUE;
   }
   return FALSE;