Hi Mark,

>asking the system for a comprehensive list of what's allowed for the user.

Here's the code to read the DACL for any file. The output is formatted as an SDDL string (Security Descriptior Definition Language). This string contains the same information that you get in Explorer when you right-click a file, choose Properties > Security > Advanced... The program requires Windows 2000 and later:

*========================================================================================
* Returns 
*========================================================================================
Procedure GetFileDACL(tcFile)

	*--------------------------------------------------------------------------------------
	* Declare API functions
	*--------------------------------------------------------------------------------------
	Declare Long GetFileSecurity in Win32API ;
		String lpFileName, ;
		Long RequestedInformation, ;
		String @pSecurityDescriptor, ;
		Long nLength, ;
		Long @lpnLengthNeeded
	Declare Long ConvertSecurityDescriptorToStringSecurityDescriptor in Win32API ;
		String SecurityDescriptor, ;
		Long RequestedStringSDRevision, ;
		Long SecurityInformation, ;
		Long @StringSecurityDescriptor, ;
		Long @StringSecurityDescriptorLen
	
	*--------------------------------------------------------------------------------------
	* Retrieve the DACL
	*--------------------------------------------------------------------------------------
	Local lcDACL, lnNeeded
	lcDACL = Space(4096)
	lnNeeded = 0
	DACL_SECURITY_INFORMATION = 0x4
	GetFileSecurity( ;
		m.tcFile, ;
		DACL_SECURITY_INFORMATION, ;
		@lcDACL, ;
		Len(m.lcDACL), ;
		@lnNeeded ;
	)
	lcDACL = Left( m.lcDACL,m.lnNeeded)

	*--------------------------------------------------------------------------------------
	* convert into SDDL
	*--------------------------------------------------------------------------------------
	Local lnSDDL, lnLength, lcSDDL
	lnSDDL = 0
	lnLength = 0
	ConvertSecurityDescriptorToStringSecurityDescriptor( ;
		m.lcDACL, ;
		1, ;
		DACL_SECURITY_INFORMATION, ;
		@lnSDDL, ;
		@lnLength ;
	)
	lcSDDL = Chrtran(Sys(2600,m.lnSDDL,m.lnLength),Chr(0),"")

Return m.lcSDDL