When sorting an access control list (ACL) canonically, the Server app first lists all entries that deny permission, then the entries that grant permission. ACL entries that deny permission have a permission type of Deny. Entries that grant permission have a permission type of Allow.
All ACL entries created with the Server app are the Allow type. Permissions of the Deny type can be created on OS X Server disks by using the chmod command-line tool. For information about chmod, see its man page.
Select your server in the Server app sidebar, then click Storage.
Select the folder or file whose ACL list you want to sort, then click the Action pop-up menu 
, then choose Edit Permissions.
In the Edit Permissions dialog, click the Action pop-up menu , then choose Sort Access Control List Canonically.