ACL operations with required object_type and optional object_id