In ACSclassic this was a huge piece of $%^& and I (and a co-worker) created a work around.
See the thread on ACS won't scale, and you will see.
Permissions in general, while noble in their design, are way screwed up and probably need to be re-written.
