acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java
public Object decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> config, Object returnedObject)
			throws AccessDeniedException {

		if (returnedObject == null) {
			// AclManager interface contract prohibits nulls
			// As they have permission to null/nothing, grant access
			logger.debug("Return object is null, skipping");

			return null;
		}

		if (!getProcessDomainObjectClass().isAssignableFrom(returnedObject.getClass())) {
			logger.debug("Return object is not applicable for this provider, skipping");

			return returnedObject;
		}

		for (ConfigAttribute attr : config) {
			if (!this.supports(attr)) {
				continue;
			}
			// Need to make an access decision on this invocation

			if (hasPermission(authentication, returnedObject)) {
				return returnedObject;
			}

			logger.debug("Denying access");

			throw new AccessDeniedException(messages.getMessage(
					"AclEntryAfterInvocationProvider.noPermission", new Object[] {
							authentication.getName(), returnedObject },
					"Authentication {0} has NO permissions to the domain object {1}"));
		}

		return returnedObject;
	}
public Object decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> config, Object returnedObject)
			throws AccessDeniedException {

		if (returnedObject == null) {
			// AclManager interface contract prohibits nulls
			// As they have permission to null/nothing, grant access
			logger.debug("Return object is null, skipping");

			return null;
		}

		if (!getProcessDomainObjectClass().isAssignableFrom(returnedObject.getClass())) {
			logger.debug("Return object is not applicable for this provider, skipping");

			return returnedObject;
		}

		for (ConfigAttribute attr : config) {
			if (!this.supports(attr)) {
				continue;
			}
			// Need to make an access decision on this invocation

			if (hasPermission(authentication, returnedObject)) {
				return returnedObject;
			}

			logger.debug("Denying access");

			throw new AccessDeniedException(messages.getMessage(
					"AclEntryAfterInvocationProvider.noPermission", new Object[] {
							authentication.getName(), returnedObject },
					"Authentication {0} has NO permissions to the domain object {1}"));
		}

		return returnedObject;
	}
========================================================================================================