...but don't all acs objects have the
same type of parent/child relationship?
No... 😊
An acs object's type inheritence is defined by its object_id, which it shares with all the objects that are above it in the hierarchy that had to be created to collectively define the top level 'foo' object, and all the objects below it that had to be created if foo is itself a parent type of some other type.
An acs object's security inheritence is defined by its context_id, and the setting of the security_inherit_p flag.
You still end up with the problem I outlined above. When you *apply* a permission, it is permission x on object_id y for user_id z. As acs objects which are in the same inheritence line share the same object_id you are applying a direct permission on each of those objects. The context_id which defines security inheritence does not play any role in this.
