The previous behavior was fail open if you were using this directly
to set the action for an AccessControlEntry, because a nil action_id
means all actions are allowed.
This more strict behavior will catch problems, and found one place
in the specs where we weren't testing what we wanted to be testing
(since the related spec had all actions allowed).