acl: user can read puavoLocked attribute