This is essentially the same feature request as the old, auto-closed, https://issues.redhat.com/browse/FD-1048:

When OVN ACLs are applied to a port group they are essentially applied to every logical switch that contains ports that are part of the port group.

However, when displaying ACLs applied on a logical switch, ovn-nbctl only returns ACLs explicitly applied on the logical switch. This makes troubleshooting more complicated.

Steps to Reproduce:

$ ovn-nbctl ls-add ls
$ ovn-nbctl lsp-add ls lsp1
$ ovn-nbctl pg-add pg1 lsp1
$ ovn-nbctl acl-add pg1 to-lport 2 udp allow
$ ovn-nbctl acl-add ls to-lport 1 ip drop

Actual results:

$ ovn-nbctl acl-list ls
to-lport 1 (ip) drop
$ ovn-nbctl acl-list pg1
to-lport 2 (udp) allow

Expected results:

$ ovn-nbctl --all acl-list ls
to-lport 2 (udp) allow
to-lport 1 (ip) drop

Additionally, users could be informed that some ACLs are applied through a port group by enhancing the output with the name of the port group the ACL was "inherited" from. E.g.:
Expected results:

$ ovn-nbctl --all acl-list ls
to-lport 2 (udp) allow   [pg1]
to-lport 1 (ip) drop