I see in the latest code that there's an access control list for ServiceManager. 

I've been digging through source code, trying to understand the list.

By the time it gets to ServiceManager it's a hash, with a Service name for the key, and regular expressions to match against a URL for the value.

I can see in where it gets set in ServiceManager, but I cannot find the origin of the data.

Where does this get set?  Who provides the access control list?

/Sam