The error means exactly what it says, 'keys' needs a hash, not a hashref, or anything else. This works:

use strict;
use warnings;

my $obj = Foo->new();

for my $key (keys %{$obj->{acls}})
{
        print "$key\n";
}

package Foo;

sub new
{
        my $self = shift;
        my %obj = (     acls => { a=>1,
                                  b=>2 }        );
        return bless \%obj;
}
[download]

Note the %{} round $obj->{acls} dereferencing the hashref into a hash.

Update: Just as added clarification, since you were talking about return values from functions:

use strict;
use warnings;

my $obj = Foo->new();

for my $key (keys %{$obj->{acls}})
{
        print "$key\n";
}
for my $key (keys %{$obj->acls})
{
        print "$key\n";
}

package Foo;

sub new
{
        my $self = shift;
        my %obj = (     acls => { a=>1,
                                  b=>2 }        );
        return bless \%obj;
}

sub acls
{
        my $self = shift;
        return \%{$self->{acls}};
}
[download]

The second for loop calls acls() to get at the content of the attribute {acls}, dereferences it, and iterates through printing the keys. The first loop is accessing the hashref directly, rather than through a function call.