code: protected AccessControlList getAccessControlList(Session session, final String path) throws RepositoryException {
  
          final AccessControlManager acm = session.getAccessControlManager();
          AccessControlList acl;
          try {
              // get first applicable policy (for nodes w/o a policy)
              acl = (AccessControlList) acm.getApplicablePolicies(path).nextAccessControlPolicy();
          } catch (NoSuchElementException e) {
              LOG.debug("no applicable policy found", e);
  
              // else node already has a policy, get that one
              acl = (AccessControlList) acm.getPolicies(path)[0];
          }
          return acl;
      }
docs: Retrieves the {@link AccessControlList} for a given path. If there is no ACL present, a new one will be created.
  
  @param session
  the current session that provides the {@link AccessControlManager}
  @param path
  the path for which the ACL should be retrieved.
  
  @return the access control list for the path
  
  @throws RepositoryException
  when the access control manager could not be retrieved or the ACLs of the specified path could not be
  obtained.