acl: use AclDefinition and its value providers