ext[234]: move over to 'check_acl' permission model