Question: why validuser acl cannot be added under user-roles?
Product and Software: This article applies to all Aruba products and version 6.2 or higher.
Validuser acl should never be used in user-role directly; as it's part of Global acls for user-table.
From 6.2 or higher we get the displaced error message "validuser ACL is a special-case ACL. Cannot be applied directly to user-role"