Apparently the order of ACEs isn't automatically inferred by Active Directory and if you create a "Deny" ACE below an "Allow" ACE it's created as-is, making the ACL out of order. If you then view the Security tab manually in the AD, it prompts the admin to "Re-order" the ACL.