Are you setting ACLs on the same datasets or separate ones? We set a global setacl lock in middleware to prevent users from clobbering same paths and to prevent overload. This could probably be relaxed to allow multiple ones on different datasets. If you’re recursing through millions of files it will potentially take a significant amount of time to complete since we have to write an ACL on every file and you’re probably iops constrained. The ACL setting application is written in C and using fts(3) + setxattr() so there’s really not any fat to trim there.