code: protected Boolean _hasPermission(@Nonnull Authentication a, Permission permission) {
          // ACL entries for this principal takes precedence
          Boolean b = hasPermission(new PrincipalSid(a),permission);
          if(LOGGER.isLoggable(FINER))
              LOGGER.finer("hasPermission(PrincipalSID:"+a.getPrincipal()+","+permission+")=>"+b);
          if(b!=null)
              return b;
  
          // after that, we check if the groups this principal belongs to
          // has any ACL entries.
          // here we are using GrantedAuthority as a group
          for(GrantedAuthority ga : a.getAuthorities()) {
              b = hasPermission(new GrantedAuthoritySid(ga),permission);
              if(LOGGER.isLoggable(FINER))
                  LOGGER.finer("hasPermission(GroupSID:"+ga.getAuthority()+","+permission+")=>"+b);
              if(b!=null)
                  return b;
          }
  
          // permissions granted to 'everyone' and 'anonymous' users are granted to everyone
          for (Sid sid : AUTOMATIC_SIDS) {
              b = hasPermission(sid,permission);
              if(LOGGER.isLoggable(FINER))
                  LOGGER.finer("hasPermission("+sid+","+permission+")=>"+b);
              if(b!=null)
                  return b;
          }
  
          return null;
      }
docs: Implementation that backs up {@link #hasPermission(Authentication, Permission)}.
  
  @return
  true or false if {@link #hasPermission(Sid, Permission)} returns it.
  Otherwise null, indicating that this ACL doesn't have any entry for it.