@okulikov answered this on IRC. Basically, AccessControlManagerImpl implements AdvancedAuthorizationProvider, and is thus instantiated by the Repository. I suggested that this be changed, to implement the AAP with a different class that sets a reference to the AccessControlManager on the session. (Note that since each JcrSession has its own ACMI, the AdvancedAuthorizationProvider implementation cannot hold onto the ACMIs except if it were to use a Map, which is far less efficient than just adding a reference to the JcrSession.)