@silverpill I see.
My ActivityPub library unfortunately relies on fresh copies of activities when operates on them, so it usually tries to fetch them (again).
I'll try to see if relying on the local copy is enough - which it mostly should I think.
Also let me know if you want me to write a quick spec about how I operate ACLs logic on the activitypub objects, which I think I mentioned multiple times, but never really bothered to formalize into a document.