code: public final SidACL newInheritingACL(final SidACL parent) {
          final SidACL child = this;
          return new SidACL() {
              protected Boolean hasPermission(Sid p, Permission permission) {
                  Boolean b = child.hasPermission(p, permission);
                  if(b!=null) return b;
                  return parent.hasPermission(p,permission);
              }
          };
      }
docs: Creates a new {@link SidACL} that first consults 'this' {@link SidACL} and then delegate to
  the given parent {@link SidACL}. By doing this at the {@link SidACL} level and not at the
  {@link ACL} level, this allows the child ACLs to have an explicit deny entry.
  Note that the combined ACL calls hasPermission(Sid,Permission) in the child and parent
  SidACLs directly, so if these override _hasPermission then this custom behavior will
  not be applied.