code: private List<String> dereferenceAgentGroups(final Collection<String> agentGroups) {
          final FedoraSession internalSession = sessionFactory.getInternalSession();
          final IdentifierConverter<Resource, FedoraResource> translator =
                  new DefaultIdentifierTranslator(getJcrSession(internalSession));
  
          final List<String> members = agentGroups.stream().flatMap(agentGroup -> {
              if (agentGroup.startsWith(FEDORA_INTERNAL_PREFIX)) {
                  //strip off trailing hash.
                  final int hashIndex = agentGroup.indexOf("#");
                  final String agentGroupNoHash = hashIndex > 0 ?
                                           agentGroup.substring(0, hashIndex) :
                                           agentGroup;
                  final String hashedSuffix = hashIndex > 0 ? agentGroup.substring(hashIndex) : null;
                  final FedoraResource resource = nodeService.find(
                      internalSession, agentGroupNoHash.substring(FEDORA_INTERNAL_PREFIX.length()));
                  return getAgentMembers(translator, resource, hashedSuffix);
              } else if (agentGroup.equals(FOAF_AGENT_VALUE)) {
                  return of(agentGroup);
              } else {
                  LOGGER.info("Ignoring agentGroup: {}", agentGroup);
                  return empty();
              }
          }).collect(toList());
  
          if (LOGGER.isDebugEnabled() && !agentGroups.isEmpty()) {
              LOGGER.debug("Found {} members in {} agentGroups resources", members.size(), agentGroups.size());
          }
  
          return members;
      }
docs: This maps a Collection of acl:agentGroup values to a List of agents.
  Any out-of-domain URIs are silently ignored.