Sometimes there's a limit to how simple something can be. And sometimes you don't want to/shouldn't hide the complications.

I think that introducing users to ACLs, permissions and security is appropriate at this step. You can have a script/process in place that can take care of this but you should explain what's going on and why. Because if there's a security issue, they can at least have some kind idea of what happened.