now using namespace "internal" for ACL-management