sql work for acl