Now that I think about it why is there not a table acs_perm with object_id, context_id and security_inherit_p that joins against acs_objects? If you want permissions add a row. That might be a pretty drastic change at this point but is perhaps how it should have worked the first place.
