pub fn classify(ace: &Ace) -> Vec<ControlPrimitive>
Every primitive one allow-ACE grants. Deny ACEs yield nothing.