[86]try {
[87]        $acl = Get-Acl -LiteralPath $item.FullName
[88]
[89]# Ensure inheritance is enabled on each node
[90]        if ($acl.AreAccessRulesProtected) {
[91]            $acl.SetAccessRuleProtection($false, $true)
[92]            Set-Acl -LiteralPath $item.FullName -AclObject $acl
[93]            $acl = Get-Acl -LiteralPath $item.FullName
[94]        }
[95]
[96]$explicitRules = $acl.Access | Where-Object { -not $_.IsInherited }
[97]
[98]foreach ($r in $explicitRules) {
[99]            # Translate to SID for reliable whitelist checks
[100]            $ruleSid = $null
[101]            try { $ruleSid = $r.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value }
[102]            catch { $ruleSid = $r.IdentityReference.Value }
[103]
[104]# Hide whitelisted identities from audit to keep CSV focused
[105]            if ($WhitelistSidSet.Contains($ruleSid)) { continue }
[106]
[107]$report.Add([pscustomobject]@{
[108]                Path              = $item.FullName
[109]                Identity          = $r.IdentityReference.Value
[110]                Rights            = $r.FileSystemRights
[111]                Type              = $r.AccessControlType
[112]                InheritanceFlags  = $r.InheritanceFlags
[113]                PropagationFlags  = $r.PropagationFlags
[114]            })
[115]        }