anchor.diff:      ),
       ?assertMatchWithPerms(
           ok,
  -        Operation(SessId, TestCaseRootDirPath, ExtraData),
  +        Operation(ExecutionerSessId, ScenarioRootDirPath, ExtraData),
           ScenarioName,
           RequiredPermsPerFile
       ),
  -    run_final_ownership_check(
  -        FileOwnerSessId, SessId, TestCaseRootDirPath, TestSpec
  -    );
  -
  -run_acl_perms_scenario(
  -    Node, FileOwnerSessId, SessId, TestCaseRootDirPath, ScenarioName,
  -    ComplementaryPermsPerFile, AllRequiredPerms, ExtraData, AceWho, AceFlags, deny,
  -    #perms_test_spec{operation = Operation} = TestSpec
  -) ->
  +    run_final_ownership_check(FileOwnerSessId, ExecutionerSessId, ScenarioRootDirPath, MetaSpec);
  +
  +run_acl_perms_scenario(#scenario_ctx{
  +    meta_spec = #perms_test_spec{
  +        test_node = Node,
  +        owner_user = FileOwnerId,
  +        operation = Operation
  +    } = MetaSpec,
  +    scenario_name = ScenarioName,
  +    scenario_root_dir_path = ScenarioRootDirPath,
  +    required_perms_per_file = PermsPerFile,
  +    extra_data = ExtraData
  +}, ExecutionerSessId, deny, AceWho, AceFlags, Config) ->
  +    FileOwnerSessId = ?config({session_id, {FileOwnerId, ?GET_DOMAIN(Node)}}, Config),
  +
       AllPermsPerFile = maps:map(fun(Guid, _) ->
           permissions_test_utils:all_perms(Node, Guid)
  -    end, ComplementaryPermsPerFile),
  +    end, PermsPerFile),
  +    {ComplementaryPermsPerFile, AllRequiredPerms} = get_complementary_perms(Node, PermsPerFile),
   
       % Denying only required perms and granting all others should result in eacces
       lists:foreach(fun({Guid, Perm}) ->
  
positive.code:         ExtraData, other, MetaSpec
      );
  
  run_share_test_scenario(#scenario_ctx{
      meta_spec = #perms_test_spec{
          test_node = Node,
          owner_user = FileOwnerId
      } = MetaSpec,
      scenario_name = ScenarioName,
      scenario_root_dir_path = ScenarioRootDirPath,
      required_perms_per_file = PermsPerFile,
      extra_data = ExtraData
  }, ExecutionerSessId, {acl, AllowOrDeny}, Config) ->
      FileOwnerSessId = ?config({session_id, {FileOwnerId, ?GET_DOMAIN(Node)}}, Config),
  
      {ComplementaryPermsPerFile, AllRequiredPerms} = get_complementary_perms(
          Node, PermsPerFile
      ),
      run_acl_perms_scenario(
          Node, FileOwnerSessId, ExecutionerSessId, ScenarioRootDirPath, ScenarioName,
          ComplementaryPermsPerFile, AllRequiredPerms, ExtraData,
          ?everyone, ?no_flags_mask, AllowOrDeny, MetaSpec
      ).
  
  
  
negative.code:     ]).
  
  
  %% @private
  -spec run_acl_perms_scenario(
      scenario_ctx(),
      ExecutionerSessId :: session:id(),
      Type :: allow | deny,
      AceWho :: binary(),
      AceFlags :: ace:bitmask(),
      ct_config()
  ) ->
      ok | no_return().
  run_acl_perms_scenario(#scenario_ctx{
      meta_spec = #perms_test_spec{
          test_node = Node,
          owner_user = FileOwnerId,
          operation = Operation
      } = MetaSpec,
      scenario_name = ScenarioName,
      scenario_root_dir_path = ScenarioRootDirPath,
      required_perms_per_file = PermsPerFile,
      extra_data = ExtraData
  }, ExecutionerSessId, allow, AceWho, AceFlags, Config) ->
      FileOwnerSessId = ?config({session_id, {FileOwnerId, ?GET_DOMAIN(Node)}}, Config),
  
      {ComplementaryPermsPerFile, AllRequiredPerms} = get_complementary_perms(Node, PermsPerFile),
      [AllRequiredPermsComb | EaccesPermsCombs] = combinations(AllRequiredPerms),
  
      % Granting all perms without required ones should result in {error, ?EACCES}
  