Modeshape now only supports ACL on a workspace level. It would be nice if Modeshape would allow for a hook to filter read / write access on nodes.

Whishlist:

• Filter search query results for nodes you have read access for, or possibly also for write access
• Apply ACL on read/write acces on the repository

Possible implementation for the filter: read the ACL policy / rules from the repository and check the given path / node, watching out not to get in an endless loop.