ACL mask usage question

[moritz]

What is the intended usage of ADMINISTRATION compared to READ, WRITE, CREATE, and DELETE. Is it a coarser grained access schema? Or are there other use cases? Just curious how people are using it.

Thanks.

Andreas

[Ben Alex]

The ACL permissions are not prescriptive, they can mean whatever you want them to mean, or you can write your own AbstractBasicAclEntry subclass that provides application-specific permissions.

Administration usually means "all permissions plus the ability to modify ACLs for this object". So a holder of administration can grant new privileges, whereas a user with write permissions can only write to the object (not its ACLs).