Keys in customUserAcls are silently ignored in case there is no equivalent user defined. Maybe the validate step could check for that.