When executing the following code:

Set<String> nodes = new TreeSet<>();  
Node parentNode = repositorySession.getNode(parentPath);  
for (NodeIterator nodeIterator = parentNode.getNodes(); nodeIterator.hasNext(); ) {  
    nodes.add(nodeIterator.nextNode().getPath());  
}  

a custom AuthorizationProvider is only called once for the parent node, it is not called for each of the child nodes that are retrieve via the iterator. Instead as long as the custom AuthorizationProvider allows the parent node to be read all of the child nodes can also be read without checking that the user has permission to do so.