This is a major sticking point for us. Many of our repos are 3rd party, made available to us under different licenses. Some require individuals to be licensed, and so we use ACLs for both read and write access. Some of our source is export-controlled and this also is enforced via ACLs at the repo level.