Move ACL update business logic in a service