There's a writeup on how Spring does this:
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/domain-acls.html
There's a writeup on how Spring does this:
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/domain-acls.html