Is ACL inheritance only at file creation time on zfs?

I'm having trouble understanding how ACLs work on ZFS as compared to how they work on a Windows NTFS system. (In particular, I'm using a TrueNAS 12.)

I create a SMB share ("smbtest"), and I give user joe Modify rights, inheritable. Then, in that share, I touch a file a, and it looks like this:

root@nisaba[/mnt/Pool1/smbtest]# getfacl a
# file: a
# owner: root
# group: wheel owner@:rwxpDdaARWcCos:------I:allow group@:rwxpDdaARWcCos:------I:allow user:joe:rwxpDdaARWc--s:------I:allow everyone@:--------------:------I:allow

Looks great.

Now I go back into the GUI and give the user mary Modify rights, inheritable. Then I touch a file b, and it looks like this:

root@nisaba[/mnt/Pool1/smbtest]# getfacl b
# file: b
# owner: root
# group: wheel owner@:rwxpDdaARWcCos:------I:allow group@:rwxpDdaARWcCos:------I:allow user:joe:rwxpDdaARWc--s:------I:allow user:mary:rwxpDdaARWc--s:------I:allow everyone@:--------------:------I:allow

Good. Now let's look at a again:

root@nisaba[/mnt/Pool1/smbtest]# getfacl a
# file: a
# owner: root
# group: wheel owner@:rwxpDdaARWcCos:------I:allow group@:rwxpDdaARWcCos:------I:allow user:joe:rwxpDdaARWc--s:------I:allow everyone@:--------------:------I:allow

It has not changed. This is a critical difference between how I'm used to a SMB share working. If I were to do this on a Windows server, after modifying the permissions of the toplevel directory smbtest, the permissions on a would have been identical to those of b, because permissions on the object are inherited. In NTFS, inheritance is not a one-shot deal - it's not that they're inherited when the object is created, they're inherited in the sense that permissions are essentially symlinked to the object they are inherited from.

It appears that's not the case here? If it's not, what's the workaround? Surely if you've got a share with a few tens of millions of files in it, and you want to add a new ACL entry to it, you don't have to recursively apply that change to tens of millions of files, instead of (as is the case in NTFS) just one object that they all dynamically inherit from?

Or am I doing something wrong?

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.