diff --git a/lib/AssetsModule.js b/lib/AssetsModule.js
index fb5448d..f840cdf 100644
--- a/lib/AssetsModule.js
+++ b/lib/AssetsModule.js
@@ -24,10 +24,11 @@ class Assetsmodule extends AbstractApiModule {
     await this.ensureLibPermissions()
     const [authored, mongodb, tags, users] = await this.app.waitForModule('authored', 'mongodb', 'tags', 'users')
     await mongodb.setIndex(this.collectionName, 'hash')
-    await authored.registerModule(this, { accessCheck: false })
+    await authored.registerModule(this)
     await tags.registerModule(this)
-    // opt into the generic _access model: public access (base) plus per-user sharing.
-    // Group sharing is wired from the usergroups module. See adapt-authoring-api#98.
+    // opt into the generic _access model: creator ownership (via authored) plus public
+    // access (base) and per-user sharing. Group sharing is wired from the usergroups
+    // module. See adapt-authoring-api#98.
     await this.enableAccessControl()
     await users.registerUserModule(this)
 
diff --git a/migrations/1.12.0.js b/migrations/1.12.0.js
new file mode 100644
index 0000000..b379a30
--- /dev/null
+++ b/migrations/1.12.0.js
@@ -0,0 +1,26 @@
+/**
+ * Backfills the generic `_access` grant on existing assets. Assets predate the access model
+ * (they were a global, scope-gated pool with no per-asset sharing), so there is no legacy
+ * field to derive from — they are made public by default, preserving the prior "everyone sees
+ * every asset" behaviour. New assets get `_access.public: true` from the schema default.
+ *
+ * Idempotent: only touches assets that don't yet carry `_access.public`. `_access.users` is
+ * preserved if already present (e.g. seeded by the usergroups groups backfill), else defaulted.
+ */
+export default function (migration) {
+  migration.describe('Backfill _access.public=true / _access.users=[] on existing assets (public by default)')
+  migration.runCommand(backfillAssetAccess)
+}
+
+async function backfillAssetAccess (db, log) {
+  const res = await db.collection('assets').updateMany(
+    { '_access.public': { $exists: false } },
+    [{
+      $set: {
+        '_access.public': true,
+        '_access.users': { $ifNull: ['$_access.users', []] }
+      }
+    }]
+  )
+  log('info', 'migrations', `Backfilled _access on ${res.modifiedCount} asset(s)`)
+}