did you consider have something like
ACL.add(user=me@example, grant=ACL.READ) instead?