I went down a rabbit hole working on OSX ACLs, luckily this page on OSX ACLs was around to help out.