anchor.diff:  
       % then
       ?assertEqual(Acl, [
  -        #access_control_entity{acetype = ?allow_mask, identifier = UserId, name = UserName, aceflags = ?no_flags_mask, acemask = ?read_mask bor ?write_mask},
  -        #access_control_entity{acetype = ?deny_mask, identifier = GroupId, name = GroupName, aceflags = ?identifier_group_mask, acemask = ?write_mask}
  +        #access_control_entity{
  +            acetype = ?allow_mask,
  +            identifier = UserId,
  +            name = UserName,
  +            aceflags = ?no_flags_mask,
  +            acemask = ?read_object_mask bor ?write_object_mask
  +        },
  +        #access_control_entity{
  +            acetype = ?deny_mask,
  +            identifier = GroupId,
  +            name = GroupName,
  +            aceflags = ?identifier_group_mask,
  +            acemask = ?write_object_mask
  +        }
       ]).
   
   
  
positive.code:     % rdwr permission on different ACEs, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace5, Ace6], User2, ?read_mask bor ?write_mask, FileCtx)),
      % rwx permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace5, Ace6], User2, ?read_mask bor ?write_mask bor ?execute_mask, FileCtx)),
      % x permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace5, Ace6], User2, ?execute_mask, FileCtx)),
      meck:validate(file_ctx),
      meck:unload().
  
  
negative.code: 
      Ace1 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId1, acemask = ?read_mask},
      Ace2 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId2, acemask = ?write_mask},
      Ace3 = #access_control_entity{acetype = ?allow_mask, aceflags = ?identifier_group_mask, identifier = GId3, acemask = ?traverse_container_mask},
  
      % read permission
      ?assertEqual(ok, acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask, FileCtx)),
      % rdwr permission on different ACEs
      ?assertEqual(ok, acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask bor ?write_mask, FileCtx)),
      % rwx permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?read_mask bor ?write_mask bor ?traverse_container_mask, FileCtx)),
      % x permission, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1, Ace2, Ace3], User1, ?traverse_container_mask, FileCtx)),
      % write, not allowed
      ?assertEqual(?EACCES, catch acl:assert_permitted([Ace1], User1, ?write_mask, FileCtx)),
  
  