diff --git a/cipd/cipd.go b/cipd/cipd.go
index f34fa95..c28f465 100644
--- a/cipd/cipd.go
+++ b/cipd/cipd.go
@@ -51,6 +51,7 @@
 windows-386     sha256  b8102c9a1b93915c128e7577c89fd77991ab83d52c356913e56ea505ab338735
 windows-amd64   sha256  a117e3984c111c68698faf91815c4b7d374404fa82dff318aadb9f2f0582ca8d
 `
+	cipdNotLoggedInStr = "Not logged in"
 )
 
 var (
@@ -244,6 +245,91 @@
 	return ioutil.ReadAll(resp.Body)
 }
 
+type packageACL struct {
+	path   string
+	access bool
+}
+
+func checkPackageACL(jirix *jiri.X, path, version string, c chan<- packageACL) {
+	// cipd should be already bootstrapped before this go routine.
+	// Silently return a false just in case if cipd is not found.
+	if cipdBinary == "" {
+		c <- packageACL{path: path, access: false}
+		return
+	}
+
+	args := []string{"resolve", path, "-version", version}
+	if jirix != nil {
+		jirix.Logger.Debugf("Invoke cipd with %v", args)
+	}
+	command := exec.Command(cipdBinary, args...)
+	var stdoutBuf, stderrBuf bytes.Buffer
+	command.Stdout = &stdoutBuf
+	command.Stderr = &stderrBuf
+	// Return false if cipd cannot be executed or cipd returned a non-zero
+	// return code, which usually means the package cannot be found due to
+	// access control.
+	if err := command.Run(); err != nil {
+		if jirix != nil {
+			jirix.Logger.Debugf("Error happend while executing cipd, err: %q, stderr: %q", err, stderrBuf.String())
+		}
+		c <- packageACL{path: path, access: false}
+		return
+	}
+	// cipd returned zero. Package can be accessed.
+	c <- packageACL{path: path, access: true}
+	return
+}
+
+// CheckPackageACL checks cipd's access to packages in map "pkgs". The package
+// names in "pkgs" should have trailing '/' removed before calling this
+// function.
+func CheckPackageACL(jirix *jiri.X, pkgs map[string]bool, versions map[string]string) error {
+	// Not declared as CheckPackageACL(jirix *jiri.X, pkgs map[*package.Package]bool)
+	// due to import cycles. Package jiri/package imports jiri/cipd so here we cannot
+	// import jiri/package.
+	if _, err := Bootstrap(); err != nil {
+		return err
+	}
+
+	c := make(chan packageACL)
+	for key := range pkgs {
+		go checkPackageACL(jirix, key, versions[key], c)
+	}
+
+	for i := 0; i < len(pkgs); i++ {
+		acl := <-c
+		pkgs[acl.path] = acl.access
+	}
+	return nil
+}
+
+// CheckLoggedIn checks cipd's user login information. It will return true
+// if login information is found or return false if login information is not
+// found.
+func CheckLoggedIn(jirix *jiri.X) (bool, error) {
+	cipdPath, err := Bootstrap()
+	if err != nil {
+		return false, err
+	}
+	args := []string{"auth-info"}
+	command := exec.Command(cipdPath, args...)
+	var stdoutBuf, stderrBuf bytes.Buffer
+	command.Stdout = &stdoutBuf
+	command.Stderr = &stderrBuf
+	if err := command.Run(); err != nil {
+		stdErrMsg := strings.TrimSpace(stderrBuf.String())
+		if jirix != nil {
+			jirix.Logger.Debugf("Error happend while executing cipd, err: %q, stderr: %q", err, stdErrMsg)
+		}
+		if _, ok := err.(*exec.ExitError); ok && stdErrMsg == cipdNotLoggedInStr {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
 // Ensure runs cipd binary's ensure funcationality over file. Fetched packages will be
 // saved to projectRoot directory. Parameter timeout is in minutes.
 func Ensure(jirix *jiri.X, file, projectRoot string, timeout uint) error {
diff --git a/cipd/cipd_test.go b/cipd/cipd_test.go
index fdff7ed..41cce90 100644
--- a/cipd/cipd_test.go
+++ b/cipd/cipd_test.go
@@ -17,6 +17,11 @@
 	// Some random valid cipd version tags from infra/tools/cipd
 	cipdVersionForTestA = "git_revision:00e2d8b49a4e7505d1c71f19d15c9e7c5b9245a5"
 	cipdVersionForTestB = "git_revision:8fac632847b1ce0de3b57d16d0f2193625f4a4f0"
+	// package path and versions for ACL tests
+	cipdPkgPathA    = "gn/gn/${platform}"
+	cipdPkgVersionA = "git_revision:bdb0fd02324b120cacde634a9235405061c8ea06"
+	cipdPkgPathB    = "notexist/notexist"
+	cipdPkgVersionB = "git_revision:bdb0fd02324b120cacde634a9235405061c8ea06"
 )
 
 var (
@@ -164,3 +169,30 @@
 		t.Errorf("failed to execute os.Stat() on fetched cipd package due to error: %v", err)
 	}
 }
+
+func TestCheckACL(t *testing.T) {
+	cipdPath, err := Bootstrap()
+	if err != nil {
+		t.Errorf("bootstrap failed due to error: %v", err)
+	}
+	defer os.Remove(cipdPath)
+
+	pkgMap := make(map[string]bool)
+	pkgMap[cipdPkgPathA] = false
+	pkgMap[cipdPkgPathB] = false
+	versionMap := make(map[string]string)
+	versionMap[cipdPkgPathA] = cipdPkgVersionA
+	versionMap[cipdPkgPathB] = cipdPkgVersionB
+	if err := CheckPackageACL(nil, pkgMap, versionMap); err != nil {
+		t.Errorf("CheckPackageACL failed due to error: %v", err)
+	}
+
+	if !pkgMap[cipdPkgPathA] {
+		t.Errorf("pkg %q should be accessible, but it is not accessible by cipd", cipdPkgPathA)
+	}
+
+	if pkgMap[cipdPkgPathB] {
+		t.Errorf("pkg %q should not be accessible, but it is accessible by cipd", cipdPkgPathB)
+	}
+
+}
diff --git a/project/manifest.go b/project/manifest.go
index 0e5162a..232fc9c 100644
--- a/project/manifest.go
+++ b/project/manifest.go
@@ -503,8 +503,28 @@
 	ensureFileBuf.WriteString("$ParanoidMode CheckPresence\n")
 	ensureFileBuf.WriteString("\n")
 
-	// TODO: perform ACL checks on internal projects
+	// Perform ACL checks on internal projects
+	pkgACLMap := make(map[string]bool)
+	pkgVersionMap := make(map[string]string)
 	for _, pkg := range pkgs {
+		pkg.Name = strings.TrimRight(pkg.Name, "/")
+		if pkg.Internal {
+			pkgACLMap[pkg.Name] = false
+			pkgVersionMap[pkg.Name] = pkg.Version
+		}
+	}
+	if len(pkgACLMap) != 0 {
+		if err := cipd.CheckPackageACL(jirix, pkgACLMap, pkgVersionMap); err != nil {
+			return err
+		}
+	}
+
+	hasSkippedPkgs := false
+	for _, pkg := range pkgs {
+		if val, ok := pkgACLMap[pkg.Name]; ok && !val {
+			hasSkippedPkgs = true
+			continue
+		}
 		cipdDecl, err := pkg.cipdDecl()
 		if err != nil {
 			return err
@@ -513,16 +533,25 @@
 		ensureFileBuf.WriteString("\n")
 	}
 
+	jirix.Logger.Debugf("Generated ensure file content:\n%v", ensureFileBuf.String())
 	if _, err := ensureFileBuf.WriteTo(ensureFile); err != nil {
 		return err
 	}
 	if err := ensureFile.Sync(); err != nil {
 		return err
 	}
-	jirix.Logger.Debugf("Generated cipd ensure file at %s ", ensureFilePath)
 	if err := cipd.Ensure(jirix, ensureFilePath, jirix.Root, fetchTimeout); err != nil {
 		return err
 	}
+	if hasSkippedPkgs {
+		cipdLoggedIn, err := cipd.CheckLoggedIn(jirix)
+		if err != nil {
+			return err
+		}
+		if !cipdLoggedIn {
+			jirix.Logger.Warningf("Some packages are skipped by cipd due to lack of access, you might want to run \"cipd auth-login\" and try again")
+		}
+	}
 
 	return nil
 }