Cloning a record can copy share grants the cloner could never create

Clone and duplicate endpoints often copy the source row, then copy its ACL or share table in the same transaction. The share dialog already stops that user from adding certain people or roles, but the