id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
39	Negative ACLs are ignored	andersk	ecprice	"Both web/getafsgroups.py and /usr/sbin/sipb-xen-remctl-update appear to treat negative ACLs as positive.

Relatedly, I discovered that the AFS libraries can query whether a given user is a member of a given group without listing the group.  This is now used on scripts; see /mit/andersk/Public/scripts/admof/admof.c.
"	defect	new	minor	Public Beta	web