That depends on how flexible you can be in defining compound principals. By default all rights for a principal MUST be denied. That goes against the grain of tradition in Web Servers, where no access control meant no access control. However, that originated in the days when HTTP was read-only for the most part. That way, it's easy to attach an ACL that changes the default.
Inheritance can either be static or dynamic.
I agree that the model should allow for access control to be applied to a resource during its creation, but I think it should deal only with static assignment of initial ACLs, and even then, not get into where the initial ACLs may have originated. Basically, when you create a resource, a server may statically assign some ACLs to it at creation. As the creator, you would normally be able to view and change these ACLs after resource creation. On the other hand, dynamic inheritance need not be prohibited, but a client needs to be able to distinguish between views of ACLs on resource as including or not including dynamically inherited ACLs. You might want to see dynamic ACLs when you're trying to determine the rights of a particular principal, but the presence of dynamic ACLs could add significant complexity to the operation of setting ACLs.