ACL permissions not working on AFP share

Got a strange one, not quite like some of the others on here.

I have a 10.6.8 server and about 50 10.8 clients.

I've set up a shared folder with posix permissions to give my logo artist ownership, wheel has read and execute, everyone has no access.

ACL is set up so the entire graphics group can read everything, but can't write or delete, and one solitary user not a member of the graphics group has read everything but can't write or delete.

Inside that folder, there's a "drop box." the main difference is that I want the users to be able to see what's in the drop box. so again, the posix permissions are the same. The ACL has the graphics group able to read everything, write but not delete. The external user has the same.

If I look at it in the Server Admin app, the ACLs are there. If I do ls -laed on the server, the ACLs are there.

if I mount the share on a client machine using AFP and one of the ACL'd accounts, the permissions are totally unexpected: I can open the folder (which if it were posix only, I couldn't because of everyone having no access.), but I can't write anything (which if it were ACLs, I should be able to.)

It doesn't seem to matter which client machine I use.

I'm confused.

anyone have any ideas?

Thanks

john