`_get_acl()` suggests that it, well, gets ACL. But it doesn't do anything to ACLs, it just returns a getter.

Therefore, I think it'd be best to name it like a class. Well, you could even create a `class` instead of the `lambda` function if you'd prefer. Name it like `ACLGroup` or maybe `ACLContains`. The latter should make it clear what the thingie does.

    is_user = ACLContains('user')
    is_developer = ACLContains('developer')