add acl to manifest to allow access