documenting acls and auth