We found another case which reproduces https://issues.jboss.org/browse/MODE-2456 defect. It happens rarely, but we don't know the correct steps how to reproduce this issue. So could you please create argument for modeshape that will never turn off access control validation for modeshape until we will find correct steps to reproduce this issue ?

Turn off is done in the JcrSession.java:2095

repository().repositoryCache().setAccessControlEnabled(false);