Remove "deny" acl, make acl_entry its own type