Access control is something that seems to come up a lot for media files. It seems that our community wants something like workflow systems, where the file remains mostly intact through its journey, but where not everyone has access to the file all the time. This isn't just Commons, it comes up in the avatar discussion, even the coding contest promotion spec. And workflow systems require very customized access control.
Right now we have a very unintuitive concept of zones, which is a limited menu of different kinds of access patterns, and you have to "physically" move a file to change the access control. It's very tied to the idea of directories and apache config, barely an abstraction. Which makes it efficient.
If you were to start from scratch you might want to design Files with access properties that were proper to the file itself. This may be incompatible with our caching strategy, since that involves PHP and even a database hit to determine who gets to see this file. Just a thought for now.