code: private void updatePermissions(AccessControlList acl) throws RepositoryException
     {
        List<ValueData> permValues = new ArrayList<ValueData>();
  
        List<AccessControlEntry> aces = acl.getPermissionEntries(); // new
        for (AccessControlEntry ace : aces)
        {
           permValues.add(new TransientValueData(ace));
        }
  
        PropertyData permProp =
           (PropertyData)dataManager.getItemData(nodeData(), new QPathEntry(Constants.EXO_PERMISSIONS, 0),
              ItemType.PROPERTY);
  
        permProp =
           new TransientPropertyData(permProp.getQPath(), permProp.getIdentifier(), permProp.getPersistedVersion(),
              permProp.getType(), permProp.getParentIdentifier(), permProp.isMultiValued(), permValues);
  
        dataManager.update(new ItemState(data, ItemState.MIXIN_CHANGED, false, null, true), false);
        dataManager.update(ItemState.createUpdatedState(permProp, true), false);
  
        session.getActionHandler().postSetPermission(this);
     }
docs: ----------------------------- Object -----------------------------