network ACL helpers;

Per our discussion today, if `to` and `from` are undefined, they will create invalid JSON, and the validator will fail, so this is good to go.