move acl provider interface in separate namespace