AccessCheckByTypeResultListAndAuditAlarmByHandle vs CreatePrivateObjectSecurityEx + AccessCheck

[m]

I may be about to answer my own question, but here it is anyway:

I have a client server application written in C where the client
authenticates with the server using one of several authentication protocols
but all protocols map to either SSPI or LogonUser() so that I can obtain at
least an impersonation token. There is a general access filter for the
server, but I need to implement some finer grained access controls for
certain functions and first though of
AccessCheckByTypeResultListAndAuditAlarmByHandle (I have security descriptor
in SDDL string format) but am wondering if it might be worth the effort to
create a hierarchical security model using CreatePrivateObjectSecurity and
friends.

There is very little info on the web about either of these functions, MSDN
only has basic API documentation, and I have never used either before, so I
would appreciate any wisdom about the relative merits of either approach.