thanks for your question.

if you would not create acp and link acpi, Mobius apply default access control policy.

Basically, Moibus allows everyone to retrieve and create access right.

but, update and delete access right is not allowed

in your actions, at (2) you created ACP and at (3) you update AE with acpi link acp created

then Moibus will apply your acp configured

if it is not working, check content(policy) of ACP if acor is 'all' or not

-----------------------------------------------------------------------------