[nfsv4] NFSv4.1 SACL attribute and AUDIT ACE: what's required?

[Mike Kupfer <[e-mail]>]

I'm trying to make sense of the final paragraph in Section 6.2.1.2 of
RFC 5661, which reads

    Support for any of the ACL attributes is optional (albeit
    RECOMMENDED).  However, a server that supports either of the new
    ACL attributes (dacl or sacl) MUST allow use of the new ACL
    attributes to access all of the ACE types that it supports.  In
    other words, if such a server supports ALLOW or DENY ACEs, then it
    MUST support the dacl attribute, and if it supports AUDIT or ALARM
    ACEs, then it MUST support the sacl attribute.

IIUC, this is forbidding a situation where (for example) the server
lists support for the dacl attribute and AUDIT ACEs but not support
for the sacl attribute.

If the server lists support for neither the dacl or sacl attributes,
it can still support AUDIT ACEs via the acl attribute.

Am I reading that correctly?

thanks,
mike