...
- Get the ACL of the requested resource, if exists, else.
- Get the ACL of the next ancestor recursively (using either ldp:contains or fedora:hasParent), if exists, else.
- If no more ancestor exist (root node reached) and no ACL is found: check a file-system or classpath-based acl:Authorization. The default action of this acl:Authorization is to Deny accessthe default root ACL allows reads.
Finding the effective authorization
...