NXP-14045: disallow negative ACLs at the API level