revising old-skool acls. ... found a bug with when clause scoping, working around it for now