It isn't strictly needed, but since you added two extra SIDs to the dacl, for the sake of looking at this later, it seems like you should also verify `sids[:current_user]` as well.