chef_acl resource

Sure, if it's clear why it fails if it does / is silently rejected and does "what it should"