I realize this is very late, but there are now some experimental functions within connectapi that you can use to read ACLs. Specifically:
library(connectapi)
client <- connect()
myapp <- content_item(client, "my-guid")
get_acl_user(myapp)
get_acl_group(myapp)
Please give that a try and let us know if you have any feedback! We have some experimental ways to "add" / change ACLs to applications in the works as well. All of this is using private Connect functionality and should definitely be considered experimental, with the hopes of getting feedback around whether this meets your needs. Hope it helps!