maybe  a method of `DefaultObjectACL` could do this