code: static Optional<ACLHandle> getEffectiveAcl(final FedoraResource resource, final boolean ancestorAcl,
                                                  final SessionFactory sessionFactory) {
          try {
  
              final FedoraResource aclResource = resource.getAcl();
  
              if (aclResource != null) {
                  final List<WebACAuthorization> authorizations =
                      getAuthorizations(aclResource, ancestorAcl, sessionFactory);
                  if (authorizations.size() > 0) {
                      return Optional.of(
                          new ACLHandle(resource, authorizations));
                  }
              }
  
              if (getJcrNode(resource).getDepth() == 0) {
                  LOGGER.debug("No ACLs defined on this node or in parent hierarchy");
                  return Optional.empty();
              } else {
                  LOGGER.trace("Checking parent resource for ACL. No ACL found at {}", resource.getPath());
                  return getEffectiveAcl(resource.getContainer(), true, sessionFactory);
              }
          } catch (final RepositoryException ex) {
              LOGGER.debug("Exception finding effective ACL: {}", ex.getMessage());
              return Optional.empty();
          }
      }
docs: Recursively find the effective ACL as a URI along with the FedoraResource that points to it.
  This way, if the effective ACL is pointed to from a parent resource, the child will inherit
  any permissions that correspond to access to that parent. This ACL resource may or may not exist,
  and it may be external to the fedora repository.
  @param resource the Fedora resource
  @param ancestorAcl the flag for looking up ACL from ancestor hierarchy resources
  @param sessionFactory session factory