The problem here is that we're never going to check if the user has access to the set, we're just returning the post regardless.
You could either manually check access to the set here
OR
return the set (not the post) in _resource() and use a sub request here to pass control to /posts/:id which will do its own access check, etc.

Does that make sense? happy to pair program on this if needed.
The ACL stuff is not as clear as I'd like.. so we could refactor to make it more obvious after this..