_acl() is introduce to produce Access-level-control objects from the permissions.
_permits() is just checking if the current user, action is allowed via the ACL list
This way the permits do not have to know anything about annotations