The ACL documentation isn't final yet...it still needs some proofreading. However, it is done, and if you wish to read it, you can do so at http://grsecurity.net/gracldoc.htm
Your doc specs out that an ACL must exist for /, so the
question if the / ACL exist in the search chain might as well be a
set default ACL action instead of a choice.
It could be nice if you added wich version of grs the doc applies to.
Is it the 1.9.4 or 1.9.5-rc1 or...?