ACLRuleAction: "allow" | "deny"