Support LDAP-based ACLs in addition to file system ACLs. Probably need to support both entitlement and group-based ACLs.