@silverpill is there some glaring thing I'm missing? I fail to believe that nobody really thought of this simplest way to handle ACLs.