XCO provisions the Access Control List (ACL) internally because there is no ACL CRUD support available from the XCO side.
Full-fledged data consistency support (any drift in the ACL rules is identified and reconciled) is available when the ACL CRUD is supported via XCO.