It now seems that ATLAS don't want the DPM ACL changes for the atlas/generated directory. I got ths email from Simone:

On 9 Feb 2007, at 03:54, Simone Campana wrote:

Hi Graeme. 

We discussed this with the DPM devels. 
The reason to change the generated 
directory ACL is to allow the SGM to run 
SAM test. Not to complicate things furher, 
I would request to have the change only to the
atlas/dq2 directory with the production 
role and leave alone the generated directory. 
I will change instructions accordingly and deal
with SAM test differently. 

So it seems that the ACL script should only be run on the dq2 directory - at least that simplifies things greatly for the sites.