Protection of ACL pages themselves

[centaure]

I notice that ACL pages such as ACL:Page/Foo1:Page1 are not protected themselves. These can be viewed by users who have neither read, nor write nor even manage permissions on Foo1:Page1.
Is this by design?
Can I just throw an error to the user who cannot manage or read Foo1:Page1? I don't see any reason why we need to show him details of ACL assignments when he has no business poking at Foo1:Page1?

[mukulagrawal78]

Any comments/feedback on how to protect ACL pages themselves?

[vitalif]

You're probably right, it should be changed. Currently there is no way to protect ACL pages.
Current behaviour was intended for corporate environment where you need no "strict isolation", but rather need users to be able to request access privately...