add ensureDataACLPermission