diff --git a/services/syncbase/server/dispatcher.go b/services/syncbase/server/dispatcher.go
index 17fb042..46f7f7e 100644
--- a/services/syncbase/server/dispatcher.go
+++ b/services/syncbase/server/dispatcher.go
@@ -9,6 +9,7 @@
 
 	wire "v.io/syncbase/v23/services/syncbase"
 	pubutil "v.io/syncbase/v23/syncbase/util"
+	"v.io/syncbase/x/ref/services/syncbase/server/interfaces"
 	"v.io/syncbase/x/ref/services/syncbase/server/nosql"
 	"v.io/syncbase/x/ref/services/syncbase/server/util"
 	"v.io/v23/rpc"
@@ -36,7 +37,7 @@
 	}
 
 	if parts[0] == util.SyncbaseSuffix {
-		return disp.s.sync, nil, nil
+		return interfaces.SyncServer(disp.s.sync), nil, nil
 	}
 
 	// Validate all key atoms up front, so that we can avoid doing so in all our
diff --git a/services/syncbase/server/interfaces/sync.vdl b/services/syncbase/server/interfaces/sync.vdl
index fe64066..082d645 100644
--- a/services/syncbase/server/interfaces/sync.vdl
+++ b/services/syncbase/server/interfaces/sync.vdl
@@ -6,6 +6,7 @@
 
 import (
 	wire "v.io/syncbase/v23/services/syncbase/nosql"
+	"v.io/v23/security/access"
 )
 
 // Sync defines methods for data exchange between Syncbases.
@@ -14,21 +15,21 @@
 	// GetDeltas returns the responder's current generation vector
 	// and all the missing log records when compared to the
 	// initiator's generation vector.
-	GetDeltas() error
+	GetDeltas() error {access.Read}
 
 	// SyncGroup-related methods.
 
 	// PublishSyncGroup is typically invoked on a "central" peer
 	// to publish the SyncGroup.
-	PublishSyncGroup(sg SyncGroup) error
+	PublishSyncGroup(sg SyncGroup) error {access.Write}
 
 	// JoinSyncGroupAtAdmin is invoked by a prospective SyncGroup member's
 	// Syncbase on a SyncGroup admin. It checks whether the requestor is
 	// allowed to join the named SyncGroup, and if so, adds the requestor to
 	// the SyncGroup.
-	JoinSyncGroupAtAdmin(sgName, joinerName string, myInfo wire.SyncGroupMemberInfo) (SyncGroup | error)
+	JoinSyncGroupAtAdmin(sgName, joinerName string, myInfo wire.SyncGroupMemberInfo) (SyncGroup | error) {access.Read}
 
 	// BlobSync methods.
 	// FetchBlob returns the requested blob.
-	FetchBlob() error
+	FetchBlob() error {access.Read}
 }
diff --git a/services/syncbase/server/interfaces/sync.vdl.go b/services/syncbase/server/interfaces/sync.vdl.go
index de16181..594ab0f 100644
--- a/services/syncbase/server/interfaces/sync.vdl.go
+++ b/services/syncbase/server/interfaces/sync.vdl.go
@@ -12,9 +12,11 @@
 	"v.io/v23"
 	"v.io/v23/context"
 	"v.io/v23/rpc"
+	"v.io/v23/vdl"
 
 	// VDL user imports
 	"v.io/syncbase/v23/services/syncbase/nosql"
+	"v.io/v23/security/access"
 )
 
 // SyncClientMethods is the client interface
@@ -169,6 +171,7 @@
 		{
 			Name: "GetDeltas",
 			Doc:  "// GetDeltas returns the responder's current generation vector\n// and all the missing log records when compared to the\n// initiator's generation vector.",
+			Tags: []*vdl.Value{vdl.ValueOf(access.Tag("Read"))},
 		},
 		{
 			Name: "PublishSyncGroup",
@@ -176,6 +179,7 @@
 			InArgs: []rpc.ArgDesc{
 				{"sg", ``}, // SyncGroup
 			},
+			Tags: []*vdl.Value{vdl.ValueOf(access.Tag("Write"))},
 		},
 		{
 			Name: "JoinSyncGroupAtAdmin",
@@ -188,10 +192,12 @@
 			OutArgs: []rpc.ArgDesc{
 				{"", ``}, // SyncGroup
 			},
+			Tags: []*vdl.Value{vdl.ValueOf(access.Tag("Read"))},
 		},
 		{
 			Name: "FetchBlob",
 			Doc:  "// BlobSync methods.\n// FetchBlob returns the requested blob.",
+			Tags: []*vdl.Value{vdl.ValueOf(access.Tag("Read"))},
 		},
 	},
 }
diff --git a/services/syncbase/vsync/syncgroup.go b/services/syncbase/vsync/syncgroup.go
index 3a9a6fb..823aeb1 100644
--- a/services/syncbase/vsync/syncgroup.go
+++ b/services/syncbase/vsync/syncgroup.go
@@ -334,7 +334,7 @@
 func getSGNameEntry(ctx *context.T, st store.StoreReader, name string) (interfaces.GroupId, error) {
 	var gid interfaces.GroupId
 	if err := util.GetObject(st, sgNameKey(name), &gid); err != nil {
-		return gid, verror.New(verror.ErrInternal, ctx, err)
+		return gid, verror.New(verror.ErrNoExist, ctx, err)
 	}
 	return gid, nil
 }
@@ -474,6 +474,7 @@
 	ss := sd.db.App().Service().Sync().(*syncService)
 
 	// Contact a SyncGroup Admin to join the SyncGroup.
+	sg = &interfaces.SyncGroup{}
 	*sg, err = sd.joinSyncGroupAtAdmin(ctx, call, sgName, ss.name, myInfo)
 	if err != nil {
 		return nullSpec, err