code: public Acl applyAcl(final String repositoryId, final String objectId, final Acl acl, final AclPropagation aclPropagation) {
  
  		final App app = StructrApp.getInstance(securityContext);
  
  		try (final Tx tx = app.tx()) {
  
  			final AbstractNode node = app.get(AbstractNode.class, objectId);
  			if (node != null) {
  
  				node.revokeAll();
  
  				// process add ACL entries
  				for (final Ace toAdd : acl.getAces()) {
  					applyAce(node, toAdd, false);
  				}
  
  				tx.success();
  
  				// return the wrapper which implements the Acl interface
  				return CMISObjectWrapper.wrap(node, null, false);
  			}
  
  		} catch (FrameworkException fex) {
  			logger.warn("", fex);
  		}
  
  		throw new CmisObjectNotFoundException("Object with ID " + objectId + " does not exist");
  	}
docs: Applies the given Acl exclusively, i.e. removes all other permissions / grants first.
  
  @param repositoryId
  @param objectId
  @param acl
  @param aclPropagation
  
  @return the resulting Acl