initial stab at fine-grained ACL support -- need a good way to test
this, have a think about it.