The way this has grown is that when you have an ACE w/the same identity, type, inherits and propagation, we assume it is the same ACE. That way you can reassign rights as needed.

And when you want to remove some that may get left over for some reason you use `ensure => absent` with the ACEs you want to remove by identity, type, inherits and propagation.