Allow control over the creation of different TopLevelItems from the ACL

Should probably use a different idiom: set a `boolean` flag only if everything _succeeds_, and then in a `finally` block delete the dir if unset.