describe ACL update behavior