Clients managed with remote execution need to:

• have acl package installed
• have remote execution's working directory on a filesystem that supports ACLs

This only applies if both connection and effective users are unprivileged users (ie. neither is root)