Aha, there's one more catch.
Start the ACL file with:
* @ALL 0
* @user 0
* @writers 16
* @focusgroup 16
* @modadmin 16
* @editors 16
* @encoders 16
* @webdev 16
* @artists 16
And:
art:private:* @focusgroup 0
art:private:* @editors 0
art:private:* @writers 0
art:private:* @modadmin 0
art:private:* @encoders 0
art:private:* @webdev 0
Now, without an explicit "art:private:* @artists 16" line later on, an artist-writer cannot see art:private.
For more information, I've attached the ACL file.