since ACL order is important, I think we need an array of one element hashes, where each hash value is an array:

<pre>
permissions => [
  &lt;identity> => [ &lt;rights>, &lt;type>, &lt;inheritance>, &lt;propagation> ],
  ...
]
</pre>

That also means each `identity` can only have one ACE entry, though Windows does have such a limitation. I think that's a problem because you may want one set of rights on the object, but additional inherit-only rights for its children. In which case, it could just be an array of arrays:

<pre>
permissions => [
  [&lt;identity, &lt;rights>, &lt;type>, &lt;inheritance>, &lt;propagation>],
  ...
]
</pre>