That is good to know, although in my case I am not trying to protect against malicious users but rather want to prevent myself and colleagues to do something we do not want to do. That said the expectation of ACLs would probably be that they actually have an effect, giving a false security...