diff --git a/services/iam/server/src/org/apache/cloudstack/iam/api/AclGroup.java b/services/iam/server/src/org/apache/cloudstack/iam/api/AclGroup.java
index 56ba0eddec8..2bdddf76105 100644
--- a/services/iam/server/src/org/apache/cloudstack/iam/api/AclGroup.java
+++ b/services/iam/server/src/org/apache/cloudstack/iam/api/AclGroup.java
@@ -16,14 +16,19 @@
 // under the License.
 package org.apache.cloudstack.iam.api;
 
-public interface AclGroup {
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface AclGroup extends InternalIdentity, Identity {
 
     String getName();
 
     String getDescription();
 
+    @Override
     long getId();
 
+    @Override
     String getUuid();
 
     String getPath();
diff --git a/services/iam/server/src/org/apache/cloudstack/iam/api/AclPolicy.java b/services/iam/server/src/org/apache/cloudstack/iam/api/AclPolicy.java
index db309c88212..302bbf37eeb 100644
--- a/services/iam/server/src/org/apache/cloudstack/iam/api/AclPolicy.java
+++ b/services/iam/server/src/org/apache/cloudstack/iam/api/AclPolicy.java
@@ -16,7 +16,10 @@
 // under the License.
 package org.apache.cloudstack.iam.api;
 
-public interface AclPolicy {
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface AclPolicy extends InternalIdentity, Identity {
 
     String getName();
 
@@ -26,8 +29,10 @@ public interface AclPolicy {
         Static, Dynamic
     }
 
+    @Override
     long getId();
 
+    @Override
     String getUuid();
 
     String getPath();
diff --git a/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java b/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java
index 1398889539c..c20989c937f 100644
--- a/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java
+++ b/services/iam/server/src/org/apache/cloudstack/iam/server/IAMServiceImpl.java
@@ -651,7 +651,7 @@ public class IAMServiceImpl extends ManagerBase implements IAMService, Manager {
                     + "; failed to revoke permission from policy.");
         }
         // remove entry from acl_entity_permission table
-        AclPolicyPermissionVO permit = _policyPermissionDao.findByPolicyAndEntity(aclPolicyId, entityType, scope, scopeId, action, null);
+        AclPolicyPermissionVO permit = _policyPermissionDao.findByPolicyAndEntity(aclPolicyId, entityType, scope, scopeId, action, Permission.Allow);
         if (permit != null) {
             // not removed yet
             _policyPermissionDao.remove(permit.getId());