Read object acl from canned acl or specific grant