I found out something else:
Starting PM doesn't louse up the ACLs. Exiting PM does.
I reset the ACLs and checked (ok), started PM and checked (ok), exited PM and checked (wrong).
I have set PM to "clear cache on exit". Let's see what this does...
Bingo: Now (option "clear on exit" disabled) the ACLs "survive" a PM start/exit cycle!