When would this occur?

Hopefully never, but since we have to search for the updated acl in the response, if the response somehow doesn't included the updated acl we need to signal that somehow. 404 here doesn't feel totally correct, but I'm not sure 500 is better. What do you think?

Not sure it's necessary tbh, you can only have up to 100 acls associated to a bucket or object;

https://cloud.google.com/storage/docs/access-control/lists#:~:text=use%20IAM%20exclusively.-,What%20is%20an%20access%20control%20list%3F,of%20one%20or%20more%20entries.

Thinking we just rely on the service response code in this case unless I'm misunderstanding.

I spoke with @frankyn offline, we came to the consensus that instead of returning an HTTP status code here, insead we will return undefined 0 to signal that it's purely a client side issue, not any system issue.