Doesn't go far enough for file servers

The problem with the system quotemstr describes is that it is path-dependent: if you look at the inherited set of ACLs attached to some directory, you cannot use it to determine what the properties of files underneath are likely to be unless you know the history of those files (which is not recorded anywhere). Worse yet, files *outside* that directory may have been affected by its ACL, as long as they were at one point within that directory -- or, rather, they would have been affected by whatever ACL it had at that point (it may have been changed, but the moved-out file's ACL would not have changed).

Thus, you cannot look at the limited set of ACLs attached directly to files and their inherited permission set to figure out what their actual ACLs are: you have to look at the whole, huge, set for every single file, because the inheritance is a thin layer atop that implementation, and the underlying layer shows through (though that it shows through on non-GUI file moves is particularly shoddy).