new algorithm for resolving ACLs, should be much better