CiviCRM Entity and ACL Permissions
I wish i would have seen this question earlier, I can certainly help you out. 

checkout civicrm_entity.api.php in the civicrm_entity module

I don't believe the controller is checking the ACL's when loading an entity. We may be able to add 'check_permissions' => True to the call there in civcirm_entity_controller.inc CivicrmEntityController::loadEntites... food for thought, make a feature request in the civicrm_entity queue if you still need this. 

Alternatively

There is a hook, hook_civicrm_entity_supported_info() that you can implement and add entities to be exposed by the module or alter settings for the currently exposed entities.  See the api information for full details. 

Here you can alter what permissions are necessary to view/add/edit/delete entities via the CiviCRM Entity Drupal based forms or even set a custom callback.

function MYMODULE_civicrm_entity_supported_info(&amp;$civicrm_entity_info) {
      $civicrm_entity_info['civicrm_contact'] = array(
        'permissions' =&gt; array(
          'access_callback' =&gt; 'MYMODULE_some_custom_callback_name'
        ),
      );
    }


This will tell CiviCRM Entity to use your custom callback instead of 'user_access' 

Your callback will look something like this:

    function MYMODULE_some_custom_callback_name($op, $entity_type, $entity, $account) {
      if (is_null($account)) {
        global $user;
        $account = $user;
      }
       if($entity_type == 'civicrm_contact' &amp;&amp; $op == 'view') {
         // fetch contact_id for user via a uf_match api get call
         // do your custom permission check
         $rules = getAllByContact($contact_id); //maybe get the acl rules for a contact
        // determine whether the contact can view with some code here
        // then assuming the contact can view the contact
        $contact_can_view = TRUE;
        // or if not
        $contact_can_view = FALSE;
         return $contact_can_view; 
       }
    }


see some useful information about getting ACL rules for a contact here:
https://wiki.civicrm.org/confluence/display/CRM/Access+Control+List+Permissioning+Specification