document and test ACLs