add support for more fine grain entity update ACLs