So, i don't know if this is a problem caused by my lack of consideration or a problem in the framework, but since it caused me some headaches i leave this here.
Following both, the INVO tutorial and the Access Control List Reference i came upon this behaviour:
My controller filenames are written uppercase, like Controller. No changes where made in phalcon config regarding prefixes or routing etc.
The Security class receives the current controller via $dispatcher->getControllerName() and this gives back a lowercase controller name.
In INVO, controller resources are written lowercase, and everything works, but if you follow the ACL Reference and write your res uppercase like $acl->addResource("Controller") yep,... thats what probably brought you here then ;)