Well, it's better to err on the side of being too restrictive. I just scanned the spec, and it's extremely vague about how to determine permissions.

The case I am thinking about is this: a tree of nodes `a/b/c/d/e`, where node `/a/b` contains ACLs that grant a bunch of read privileges, but most users have no write privilege at/under `/a/b` while only some users have write privilege on `/a/b/c/d`. How would we represent this with ACLs.

One option is to have a READ ACL at `/a/b` for the appropriate users, and then a WRITE ACL at `/a/b/c/d` for the smaller set of users. However, this makes it harder to determine if a particular user can READ `/a/b/c/d/e`, since that would require walking up the ancestors until a particular permission is found.

The other option is that at `/a/b/c/d` we have to define all  of the permissions at that point, including re-specifying the READ permissions. That makes it harder to manage, but easier/faster to check. It sounds like this is the approach we went for.