Have a program that determines what a directory's ACLs should be, then uses a syscall to have setfacl...

Have a program that determines what a directory's ACLs should be, then uses a syscall to have setfacl do that. 

I had been letting setfacl handle the recursion, but we've decided that enough active stuff happens, stuff that generated LARGE DATA, that handling the recursion myself is to be done. And this includes symbolic links.

I hate learning experiences.

Link