(I first thought it could be deferred, but since the exception can happen
just due to incorrect config input, it should be guaranteed from the
beginning.)

Also made sure that both the default ACL and zone config are changed
atomically under the protection of lock.