The "on" block is a local scope so the "sid" variable needs to be scoped above so that the "on" blocks can see the variable. If the SID comes back "null" the ACL module will fail and if the SID is incorrect the verification block will catch the difference.