code: public AccessControlList getACL(QPath path) throws RepositoryException
     {
        long start = 0;
        if (LOG.isDebugEnabled())
        {
           start = System.currentTimeMillis();
           LOG.debug("getACL(" + path.getAsString() + " ) >>>>>");
        }
  
        try
        {
           NodeData parent = (NodeData)getItemData(Constants.ROOT_UUID);
           if (path.equals(Constants.ROOT_PATH))
           {
              return parent.getACL();
           }
  
           ItemData item = null;
           QPathEntry[] relPathEntries = path.getRelPath(path.getDepth());
           for (int i = 0; i < relPathEntries.length; i++)
           {
              if (i == relPathEntries.length - 1)
              {
                 item = getItemData(parent, relPathEntries[i], ItemType.NODE);
              }
              else
              {
                 item = getItemData(parent, relPathEntries[i], ItemType.UNKNOWN);
              }
  
              if (item == null)
              {
                 break;
              }
  
              if (item.isNode())
              {
                 parent = (NodeData)item;
              }
              else if (i < relPathEntries.length - 1)
              {
                 throw new IllegalPathException("Get ACL. Path can not contains a property as the intermediate element");
              }
           }
  
           if (item != null && item.isNode())
           {
              // node ACL
              return ((NodeData)item).getACL();
           }
           else
           {
              // item not found or it's a property - return parent ACL
              return parent.getACL();
           }
        }
        finally
        {
           if (LOG.isDebugEnabled())
           {
              LOG.debug("getACL(" + path.getAsString() + ") <<<<< " + ((System.currentTimeMillis() - start) / 1000d)
                 + "sec");
           }
        }
     }
docs: Return the ACL of the location. A session pending changes will be searched too. Item path will
  be traversed from the root node to a last existing item.
  
  @param path
  - path of an ACL
  @return - an item or its parent ancestor ACL
  @throws RepositoryException