Set machine_access to be a private attribute of machine, so the acl is
drwxr-xr-x - code
drwxr-xr-x - debian
drwxr-xr-x - files