Function grants_broad_write 

pub fn grants_broad_write(descriptor: &str) -> bool

Whether a DACL lets a local user unrelated to this product write inside the object it protects.

This is the security preflight 04-security-recovery.md requires and the reason an existing root can fail an install. It is the write counterpart of the read question crate::process::permissions_summary answers, and the two differ in more than the mask: a directory whose DACL is merely readable is a diagnostic, while one that is writable is an execution boundary.

Inheritance flags are ignored on purpose. An inherit-only broad ACE grants nothing on the root and everything on the attempt directories created below it, which is the half that matters.