I've confirmed the ACLs are not necessary, it creates an "allow everything" ACL by default.