allow changing the default (empty ACL) behavior