diff --git a/commonspace/object/acl/list/list_test.go b/commonspace/object/acl/list/list_test.go
index e00155e0..d5d7bc5c 100644
--- a/commonspace/object/acl/list/list_test.go
+++ b/commonspace/object/acl/list/list_test.go
@@ -1,9 +1,12 @@
 package list
 
 import (
+	"context"
 	"fmt"
+	"path/filepath"
 	"testing"
 
+	anystore "github.com/anyproto/any-store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -21,6 +24,17 @@ type aclFixture struct {
 	spaceId     string
 }
 
+func createStore(ctx context.Context, t *testing.T) anystore.DB {
+	path := filepath.Join(t.TempDir(), "list.db")
+	db, err := anystore.Open(ctx, path, nil)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := db.Close()
+		require.NoError(t, err)
+	})
+	return db
+}
+
 var mockMetadata = []byte("very important metadata")
 
 func newFixture(t *testing.T) *aclFixture {
@@ -29,9 +43,16 @@ func newFixture(t *testing.T) *aclFixture {
 	accountKeys, err := accountdata.NewRandom()
 	require.NoError(t, err)
 	spaceId := "spaceId"
-	ownerAcl, err := NewInMemoryDerivedAcl(spaceId, ownerKeys)
+	ctx := context.Background()
+	ownerAcl, err := newDerivedAclWithStoreProvider(spaceId, ownerKeys, []byte("metadata"), func(root *consensusproto.RawRecordWithId) (Storage, error) {
+		store := createStore(ctx, t)
+		return CreateStorage(ctx, root, store)
+	})
 	require.NoError(t, err)
-	accountAcl, err := newInMemoryAclWithRoot(accountKeys, ownerAcl.Root())
+	accountAcl, err := newAclWithStoreProvider(ownerAcl.Root(), accountKeys, func(root *consensusproto.RawRecordWithId) (Storage, error) {
+		store := createStore(ctx, t)
+		return CreateStorage(ctx, root, store)
+	})
 	require.NoError(t, err)
 	require.Equal(t, ownerAcl.AclState().lastRecordId, ownerAcl.Id())
 	require.Equal(t, ownerAcl.AclState().lastRecordId, accountAcl.AclState().lastRecordId)
diff --git a/commonspace/object/acl/list/listutils.go b/commonspace/object/acl/list/listutils.go
index 876a476f..a404e7bd 100644
--- a/commonspace/object/acl/list/listutils.go
+++ b/commonspace/object/acl/list/listutils.go
@@ -6,41 +6,34 @@ import (
 	"github.com/anyproto/any-sync/util/crypto"
 )
 
+type StorageProvider func(root *consensusproto.RawRecordWithId) (Storage, error)
+
 func NewInMemoryDerivedAcl(spaceId string, keys *accountdata.AccountKeys) (AclList, error) {
 	return newInMemoryDerivedAclMetadata(spaceId, keys, []byte("metadata"))
 }
 
+func newAclWithStoreProvider(root *consensusproto.RawRecordWithId, keys *accountdata.AccountKeys, storeProvider StorageProvider) (AclList, error) {
+	storage, err := storeProvider(root)
+	if err != nil {
+		return nil, err
+	}
+	return BuildAclListWithIdentity(keys, storage, NoOpAcceptorVerifier{})
+}
+
+func newDerivedAclWithStoreProvider(spaceId string, keys *accountdata.AccountKeys, metadata []byte, storeProvider StorageProvider) (AclList, error) {
+	root, err := buildDerivedRoot(spaceId, keys, metadata)
+	if err != nil {
+		return nil, err
+	}
+	return newAclWithStoreProvider(root, keys, storeProvider)
+}
+
 func newInMemoryDerivedAclMetadata(spaceId string, keys *accountdata.AccountKeys, metadata []byte) (AclList, error) {
-	builder := NewAclRecordBuilder("", crypto.NewKeyStorage(), keys, NoOpAcceptorVerifier{})
-	masterKey, _, err := crypto.GenerateRandomEd25519KeyPair()
+	root, err := buildDerivedRoot(spaceId, keys, metadata)
 	if err != nil {
 		return nil, err
 	}
-	newReadKey := crypto.NewAES()
-	privKey, _, err := crypto.GenerateRandomEd25519KeyPair()
-	if err != nil {
-		return nil, err
-	}
-	root, err := builder.BuildRoot(RootContent{
-		PrivKey:   keys.SignKey,
-		SpaceId:   spaceId,
-		MasterKey: masterKey,
-		Change: ReadKeyChangePayload{
-			MetadataKey: privKey,
-			ReadKey:     newReadKey,
-		},
-		Metadata: metadata,
-	})
-	if err != nil {
-		return nil, err
-	}
-	st, err := NewInMemoryStorage(root.Id, []*consensusproto.RawRecordWithId{
-		root,
-	})
-	if err != nil {
-		return nil, err
-	}
-	return BuildAclListWithIdentity(keys, st, NoOpAcceptorVerifier{})
+	return newInMemoryAclWithRoot(keys, root)
 }
 
 func newInMemoryAclWithRoot(keys *accountdata.AccountKeys, root *consensusproto.RawRecordWithId) (AclList, error) {
@@ -52,3 +45,26 @@ func newInMemoryAclWithRoot(keys *accountdata.AccountKeys, root *consensusproto.
 	}
 	return BuildAclListWithIdentity(keys, st, NoOpAcceptorVerifier{})
 }
+
+func buildDerivedRoot(spaceId string, keys *accountdata.AccountKeys, metadata []byte) (root *consensusproto.RawRecordWithId, err error) {
+	builder := NewAclRecordBuilder("", crypto.NewKeyStorage(), keys, NoOpAcceptorVerifier{})
+	masterKey, _, err := crypto.GenerateRandomEd25519KeyPair()
+	if err != nil {
+		return nil, err
+	}
+	newReadKey := crypto.NewAES()
+	privKey, _, err := crypto.GenerateRandomEd25519KeyPair()
+	if err != nil {
+		return nil, err
+	}
+	return builder.BuildRoot(RootContent{
+		PrivKey:   keys.SignKey,
+		SpaceId:   spaceId,
+		MasterKey: masterKey,
+		Change: ReadKeyChangePayload{
+			MetadataKey: privKey,
+			ReadKey:     newReadKey,
+		},
+		Metadata: metadata,
+	})
+}