... bad API ... head is spinning ...

Access control isn’t exactly a simple topic, but Microsoft really aren’t going out of their way to make life easy for developers who have to deal with it. Why, oh why, can’t they make a simple API with straightforward functions for manipulating things, and then provide source code for standard helper functions that use the simple API, instead of having umpty-bazillion redundant functions?