Currently create entity handles the case where something is added to root.  That needs to be generalized such that an move would setup the ACL the same way as a create.