small acl validation