configurations: added acl.xml

Should be safe to use, taken through core code repository.