Do entire ACL update in a transaction, not for each machine.