Maybe it would be usefull to have some detail in AclException what in Acl failed. So pass string with something like Set qualifier failed and maybe also store result? I am not sure what is exacly needed to know why it failed, but this doesn't look like sufficient.