d is an abbreviation for
default. The default and actual permissions are independent. Run the setfacl command a second time without the
d:, then the permissions should work as desired. I assume you want the effect of both commands.
The output of
getfacl can suggest this conclusion to you, by
- showing the original Access Control Entries which do not contain "default", indicating that there is something different about the entry you made.
In turn, the
+ in the output of
ls -l, shows that there are ACE's, which permit accesses not otherwise expected from the basic mode (there is no way standard POSIX ACE's can deny an accesses permitted by the basic mode you see). After the second setfacl command, you will notice that the basic mode changes to
rwxrwxr-x. This is because
employeers is the primary group of the file, and setfacl avoids creating a duplicate entry.
 Windows and NFSv4 ACLs allow deny entries. Many consider this to be a complexity trap, including the manpage for nfs4_acl. Naturally this means ACL order is significant. Apparently Windows GUIs change them to a "preferred" order with explicit deny entries first, and inherited entries at the end.