As per the data model, it should inherit ACL entries from the DifferentialExpressionAnalysis that owns it.

The bug is in gsec which recursively resolves the parent identity instead of just taking the parent at creation time.