Setting up my first TrueNAS (SCALE 25.04). 
While installing an app I noticed that there was an option to enable ACLs in the app config. What’s the difference between the ACLs on the app config and the ACLs on the dataset config? Does each serve a completely different purpose? Are the ACLs on the app config applied dynamically only when the app is running?