The OnDemand Administrator (ODSAdmin) object must be a trustee of the ACL rules so that OnDemand Services can read and update the rules.
Right-click the ACL Rule object, then click Trustees of This Object.
Click Add Trustee, browse for and select the ODSAdmin object, then click OK to display the Rights Assigned to Selected Objects dialog box.
Leave [Entry Rights] set to the defaults.
Select [All Attributes Rights], then click Write. Compare, Read, and Write should all be selected.
Click OK to add the ODSAdmin user to the list of trustees.
Click OK to close the Trustees of This Object page.