I don't follow this logic. If the node *does* have an ACL child node, then this method returns an empty list? And if the node *does not* have an ACL child node, then we return an iterator over the AC policies?