...
- The applicable ACL for a resource can be located by any of the methods described in Sec. 5 of the Fedora Specification (which relies on SOLIDWEBAC):
- directly attached to the resource
- determined by inheritance (via ldp:contains)
- the repository default (if no applicable ACL is found)
- [and possibly determined by inference? (i.e. accessToClass)]
- When versions are created, the ACL of the parent resource canonical resource applies also to the versions
- Throughout the lifecycle of the versions, the applicable ACL continues to be the ACL of the parentcanonical resource
- if the ACL itself is modified, the authorizations for the parent canonical resource and all versions would change because that ACL is still the applicable ACL
- if a different ACL becomes the applicable ACL (because of changes to repository resources, and still according to the rules described above for determining the applicable ACL), the ACL that applies to all versions will also change (in spite of the fact that versions are immutable)
...