ACL checking of a handler against a user's permissions
Add ACL when creating box