cshs-term-access-hook

diff --git a/src/CshsOptionsFromHelper.php b/src/CshsOptionsFromHelper.php
index 011b2a86..ec168e46 100644
--- a/src/CshsOptionsFromHelper.php
+++ b/src/CshsOptionsFromHelper.php
@@ -317,6 +317,10 @@ private function getOptions(string $vocabulary_id, int $parent = 0, $none_value
         };
       }
 
+      // contexts for alter hook
+      $account = \Drupal::entityTypeManager()->getStorage('user')->load(\Drupal::currentUser()->id());
+      $field_name = $this->fieldDefinition->getName();
+
       foreach ($storage->loadTree($vocabulary_id, $parent, $max_depth, FALSE) as $term) {
         \assert($term instanceof \stdClass);
         \assert(\is_array($term->parents));
@@ -325,8 +329,23 @@ private function getOptions(string $vocabulary_id, int $parent = 0, $none_value
         \assert(\is_numeric($term->tid));
         \assert(\is_string($term->name));
 
+        $hasAccess = TRUE;
+
+        $hooks = [
+          'cshs_term_access',
+          "cshs_{$field_name}_term_access",
+        ];
+
+        $contexts = [
+          'term' => $term,
+          'account' => $account,
+          'field_name' => $field_name
+        ];
+        // Allow other modules to override access
+        \Drupal::moduleHandler()->alter($hooks, $hasAccess, $contexts);
+
         // Allow only published terms.
-        if ((bool) $term->status) {
+        if ((bool) $term->status && $hasAccess) {
           $parents = \array_values($term->parents);
           $cache[$cache_id][$term->tid] = [
             'name' => \str_repeat('- ', $term->depth) . $get_name($term),