If anybody's interested these are the ACLs I made in Config.pm:

And right after posting I realized a much nicer way of constructing the ACLs. # nobody can move tickets by default. $Self->{TicketAcl}->{'ACL-1'} = { # match properties Properties => { }, # return possible options Possible => { Action => { AgentTicketMove => 0, }, }, }; # supervisors can move tickets. $Self->{TicketAcl}->{'ACL-2'} = { # match properties Properties => { User => { Group_rw => ['supervisor'], }, }, # return possible options Possible => { Action => { AgentTicketMove => 1, }, }, };