acl: API cleanup