The auth service is a shared service, but it is not designed to be so.

[srayner]

Either the design needs to be changed to make this work as a shared service, or the config needs to be changed to make it not shared.

The resource is added to the acl when you call the isAllowed() method. If you call isAllowed() more than once, it will attempt to load the resource into the acl again and potentially fail with an error. This is because it was assumed that a fresh instance of the service is created each time, but that is not the case with a shared service.

[srayner]

The same is true after delete a privilege. It looks like we are redirecting to list of privileges, but because the id parameter is missing, it is further redirecting to list of resources.