ACL resource restrictions question