Only users with MANAGE_NODE_PERMISSIONS change ACL. Inheritance may apply from parent nodes. Dashboard: Node permissions.
Editors · Access
Node permissions
Per-node ACL in the overlay sidebar can allow or deny roles/users beyond the baseline preset.