correctly sort reason selectors and enforce ACLs, #32521, from #31702