ACLs based on custom field pairings