You don’t need to guess, there is the HIS field in the logs to see what happened in the ACL evaluation