I was testing an external_acl_type and set ttl=3 so my script would be called often enough to see what was happening. This seemed to result in the acl logging as denied fairly regularly, even though it definitely returns OK. Putting ttl up to 30 seconds seems to make all the problems go away. Obviously 3 seconds is a dumb ttl, even for testing, but is this expected? Thanks James
