ACL is updated based on permission level