ACL: write vs. manage