code: private AccessControlList getNearestACAncestorAcl(NodeData node, ACLSearch search) throws RepositoryException
     {
        String id = node.getParentIdentifier();
        if (id != null)
        {
           boolean filtersEnabled = this.filtersEnabled.get();
           BloomFilter<String> filterPermissions = this.filterPermissions;
           BloomFilter<String> filterOwner = this.filterOwner;
           if (filtersEnabled && filterOwner != null && filterPermissions != null)
           {
              QPathEntry[] entries = node.getQPath().getEntries();
              for (int i = entries.length - 2; i >= 0; i--)
              {
                 QPathEntry entry = entries[i];
                 String currentId = entry.getId();
                 if (currentId == null)
                 {
                    // the path doesn't contain any id so we do a normal call
                    break;
                 }
                 else if ((!search.hasOwner() && filterOwner.contains(currentId))
                    || (!search.hasPermissions() && filterPermissions.contains(currentId)))
                 {
                    id = currentId;
                    break;
                 }
                 else
                 {
                    id = currentId;
                 }
              }
           }
           NodeData parent = getACL(id, search);
           if (parent != null && parent.getACL() != null)
           {
              // has an AC parent
              return parent.getACL();
           }
        }
        return new AccessControlList();
     }
docs: Traverse items parents in persistent storage for ACL containing parent. Same work is made in
  SessionDataManager.getItemData(NodeData, QPathEntry[]) but for session scooped items.
  
  @param node
  - item
  @param search
  - indicates what we are looking for
  @return - parent or null
  @throws RepositoryException