better acl validation