move ACL into config