diff --git a/src/ast/access.h b/src/ast/access.h
index 664e5e3ccb..34d93e8535 100644
--- a/src/ast/access.h
+++ b/src/ast/access.h
@@ -24,13 +24,15 @@ namespace ast {
 /// The access control settings
 enum Access {
   /// Not declared in the source
-  kUndefined,
+  kUndefined = 0,
   /// Read only
   kRead,
   /// Write only
   kWrite,
   /// Read write
-  kReadWrite
+  kReadWrite,
+  // Last valid access mode
+  kLastValid = kReadWrite,
 };
 
 /// @param out the std::ostream to write to
diff --git a/src/transform/binding_remapper.cc b/src/transform/binding_remapper.cc
index 67d47cd030..adecc8464c 100644
--- a/src/transform/binding_remapper.cc
+++ b/src/transform/binding_remapper.cc
@@ -113,6 +113,13 @@ void BindingRemapper::Run(CloneContext& ctx, const DataMap& inputs, DataMap&) {
       auto ac_it = remappings->access_controls.find(from);
       if (ac_it != remappings->access_controls.end()) {
         ast::Access ac = ac_it->second;
+        if (ac > ast::Access::kLastValid) {
+          ctx.dst->Diagnostics().add_error(
+              diag::System::Transform,
+              "invalid access mode (" +
+                  std::to_string(static_cast<uint32_t>(ac)) + ")");
+          return;
+        }
         auto* sem = ctx.src->Sem().Get(var);
         if (sem->StorageClass() != ast::StorageClass::kStorage) {
           ctx.dst->Diagnostics().add_error(