Handle special scopeId = -1 case for current domain or current account
in AclPolicyPermission table.