Enforcing attribute ACL on add operations