Rewrote the entire "ACL" (made it into groups to fit LDAP better)