After adding NTFS security permissions to an FSx ONTAP SMB share, users are still unable to access it. The key to this issue is: the effective Windows SMB permission is the intersection of share permissions and NTFS permissions, and Kerberos tickets do not automatically refresh group membership while the user remains logged in.