Add a check to client lists
Experiment: inherit the parent's ACL rather than the default for that container