The question is - how to do it? We all agree that DACLs are a Good Thing, but how many have actually implemented such a system, especially without killing performance trying to do a bazillion access ...