Answer
Use the documented predefined-parameter token for the current user (typically entered as a specific reserved keyword, not a real user ID) in the condition field, then confirm it — this is how an ACL condition is scoped to "whoever is logged in" dynamically rather than to one hardcoded account.