My dividing line for this was "bucket controls it's REST calls". 

To be honest -- down the line we cold make the ACL a full-fledged object pointing to it's own resource (https://developers.google.com/storage/docs/json_api/v1/bucketAccessControls) but this was the path I went without using those resources.