ACL Roles are usually redundant with "Access Control" Group type.

While it's easy enough to vaguely imagine a scenario where one might wish to define ACL roles separately from "Access Control" groups, in practice, I've never once done it, and i doubt I ever will.

I would vote for removing the concept of ACL role entirely, and just treating Access Control Groups as such.

If not that, one should at least be able to assign an ACL to a group directly, so it becomes potentially a one step process, instead of a three step process.