Fix: xml: Allow new objects to be created provided they subseqently match a configured ACL