I'll have to try this, but I don't think it'll solve my problem, because the ES_AUTH_RESULT_ALLOW flag will only be unset if an ES client disallowed the operation, not if it failed because of file permissions.