masks ACL, workspaces forced sync