add ability to pass null plan into acl provider