Function validate_required_columns 

pub fn validate_required_columns(
    class_name: &str,
    object: &ParseMap,
    is_update: bool,
) -> Result<(), ParseError>

Enforce requiredColumns.write (validateRequiredColumns, SchemaController.js:1332-1354).

Two things about this are easy to get wrong, and both are wire-visible.

Only the first missing column is reported. missingColumns[0] + ' is required.', so a _Role with neither name nor ACL reports name is required. and nothing about the ACL.

Create and update ask different questions. On create the test is JavaScript falsiness, so "", 0 and false are all missing, not just absent. On update the column is only missing if the body is actively deleting it, which is why an ordinary role rename does not have to resend the ACL. is_update is upstream’s query && query.objectId.

_Role’s ACL requirement is the load-bearing one: without it a role saves with no ACL and is therefore world-writable, so any client can add itself to it. That also fixes where the call belongs: pass the client-supplied body, before the REST layer lowers ACL into _rperm/_wperm, or the check looks at a key that is no longer there.