No, the other actions only control a workflow. Here there is a workflow + business logic. You should put the business logic inside a Handler service.

I have another question: does the getAclUsers() return all users from the database ?