It is not good to update existing action (but doable if you use the same id but prefixed by the original module). You should consider create a new one with his own domain.
Access right should not be used for convenient display but only to apply global restrictions.