acl: CLI allow replace, allow deletion