Suggested managed ACL

An managed ACL that is full access, but without the ability to add access, revoke access or change any permissions, would be useful.

Agreed. It’s now available as ‘Full account content access’.