default to first allowed_acs, not a literal string