Search ACLs

'sufficient' is a special case for which the hard flag does not apply