It might be good to note in the javadoc that if ACL's are defined but disabled all viewers are assumed to have access regardless of the ACL. Currently it's sort of a hidden semantic in this function. Alternatively, maybe this could be restructured so that the caller is expected to check `uiAclsEnabled` first - and this only returns permissions based on the defined ACL if present. Since it's only called once that probably wouldn't be so bad.

Up to you but it would be great to do one or the other.