If ACL does not include any manage rights, it can only be modified by administrators and users who have the right through namespace or category right.