Changing ACLs in dynamic configuration off-line