anchor.diff:                  <<"acetype">> => <<"ALLOW">>,
                   <<"identifier">> => <<UserName/binary, "#", UserId/binary>>,
                   <<"aceflags">> => <<"NO_FLAGS">>,
  -                <<"acemask">> => <<"READ_ALL, WRITE_ALL">>
  +                <<"acemask">> => <<"READ_OBJECT, WRITE_OBJECT">>
               },
               #{
                   <<"acetype">> => <<"DENY">>,
                   <<"identifier">> => <<GroupName/binary, "#", GroupId/binary>>,
                   <<"aceflags">> => <<"IDENTIFIER_GROUP">>,
  -                <<"acemask">> => <<"WRITE_ALL">>
  +                <<"acemask">> => <<"WRITE_OBJECT">>
               }
           ],
           cdmi
  
positive.code:     % rdwr permission on different ACEs
      ?assertEqual(ok, acl:assert_permitted([Ace5, Ace6], User1, ?read_mask bor ?write_mask, FileCtx)),
      % rwx permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace5, Ace6], User1, ?read_mask bor ?write_mask bor ?execute_mask, FileCtx)),
      % x permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace5, Ace6], User1, ?execute_mask, FileCtx)),
      meck:validate(file_ctx),
      meck:unload().
  
  
negative.code: 
      Ace1 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId1, acemask = ?read_mask},
      Ace2 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId2, acemask = ?write_mask},
      Ace3 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId3, acemask = ?traverse_container_mask},
  
      % read permission
      ?assertEqual(ok, acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask, FileCtx)),
      % rdwr permission on different ACEs
      ?assertEqual(ok, acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask bor ?write_mask, FileCtx)),
      % rwx permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask bor ?write_mask bor ?traverse_container_mask, FileCtx)),
      % x permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?traverse_container_mask, FileCtx)),
      % write, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1], User1, ?write_mask, FileCtx)),
  
  