add "self" to access control lists