untested generic acl functions