classifier-based ACL: refactor + add output ACL

No match.