core/src/main/java/org/sakaiproject/nakamura/lite/accesscontrol/AccessControlManagerImpl.java
public PropertyAcl getPropertyAcl(String objectType, String objectPath) throws AccessDeniedException, StorageClientException {
        long t = System.currentTimeMillis();
        checkOpen();
        compilingPermissions.inc();
        try {
            String key = this.getAclKey(objectType, objectPath);
            Map<String, Object> objectAcl = getCached(keySpace, aclColumnFamily, key);
            Set<String> orderedPrincipals = Sets.newLinkedHashSet();
            {
                String principal = user.getId();
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            for (String principal : getPrincipals(user)) {
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            // Everyone must be the last principal to be applied
            if (!User.ANON_USER.equals(user.getId())) {
                orderedPrincipals.add(Group.EVERYONE);
            }
            // go through each principal
            Map<String, Integer> grants = Maps.newHashMap();
            Map<String, Integer> denies = Maps.newHashMap();
            for (String principal : orderedPrincipals) {
                // got through each property
                String ppk = PROPERTY_PRINCIPAL_STEM + principal;
                for (Entry<String, Object> e : objectAcl.entrySet()) {
                    String k = e.getKey();
                    if (k.startsWith(ppk)) {
                        String[] parts = StringUtils.split(k.substring(PROPERTY_PRINCIPAL_STEM.length()), "@");
                        String propertyName = parts[1];
                        if (AclModification.isDeny(k)) {
                            int td = toInt(e.getValue());
                            denies.put(propertyName, toInt(denies.get(propertyName)) | td);
                        } else if (AclModification.isGrant(k)) {
                            int tg = toInt(e.getValue());
                            grants.put(propertyName, toInt(grants.get(propertyName)) | tg);
                        }
                    }
                }
            }
            // if the property has been granted, then that should remove the
            // deny
            for (Entry<String, Integer> g : grants.entrySet()) {
                String k = g.getKey();
                if (denies.containsKey(k)) {
                    denies.put(k, toInt(denies.get(k)) & ~g.getValue());
                }
            }
            return new PropertyAcl(denies);
        } finally {
            compilingPermissions.dec();
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "getPropertyAcl", System.currentTimeMillis() - t);
        }

    }
public PropertyAcl getPropertyAcl(String objectType, String objectPath) throws AccessDeniedException, StorageClientException {
        long t = System.currentTimeMillis();
        checkOpen();
        compilingPermissions.inc();
        try {
            String key = this.getAclKey(objectType, objectPath);
            Map<String, Object> objectAcl = getCached(keySpace, aclColumnFamily, key);
            Set<String> orderedPrincipals = Sets.newLinkedHashSet();
            {
                String principal = user.getId();
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            for (String principal : getPrincipals(user)) {
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            // Everyone must be the last principal to be applied
            if (!User.ANON_USER.equals(user.getId())) {
                orderedPrincipals.add(Group.EVERYONE);
            }
            // go through each principal
            Map<String, Integer> grants = Maps.newHashMap();
            Map<String, Integer> denies = Maps.newHashMap();
            for (String principal : orderedPrincipals) {
                // got through each property
                String ppk = PROPERTY_PRINCIPAL_STEM + principal;
                for (Entry<String, Object> e : objectAcl.entrySet()) {
                    String k = e.getKey();
                    if (k.startsWith(ppk)) {
                        String[] parts = StringUtils.split(k.substring(PROPERTY_PRINCIPAL_STEM.length()), "@");
                        String propertyName = parts[1];
                        if (AclModification.isDeny(k)) {
                            int td = toInt(e.getValue());
                            denies.put(propertyName, toInt(denies.get(propertyName)) | td);
                        } else if (AclModification.isGrant(k)) {
                            int tg = toInt(e.getValue());
                            grants.put(propertyName, toInt(grants.get(propertyName)) | tg);
                        }
                    }
                }
            }
            // if the property has been granted, then that should remove the
            // deny
            for (Entry<String, Integer> g : grants.entrySet()) {
                String k = g.getKey();
                if (denies.containsKey(k)) {
                    denies.put(k, toInt(denies.get(k)) & ~g.getValue());
                }
            }
            return new PropertyAcl(denies);
        } finally {
            compilingPermissions.dec();
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "getPropertyAcl", System.currentTimeMillis() - t);
        }

    }
Property principals are stored with keys of the form
_pp_<principal>@<property>@<g|d> where principal is a principal. For the
acl to be selected for the used of this session, they must have that
principal. property is the name of the property. g or d is grant or deny.
The value of the ACE is the bitmap for the ACE. All ACEs are selected and
processed to form the ACE for the user, returned as a PropertyAcl.