functions in ACL were not resolved properly, required function expansion before rewriting the ACL constraint