compatibility: acl rules in a federation