ACL: reject empty ACL