...

1. Enforce ACLs on ACL resources with filesystem-based backstop
2. Add ACL uris to response headers as "Link: <acl-uri>; rel=acl"
3. Implement acl:Control, acl:Append, and acl:Delete modes
4. F4 MUST provide a way for external services such as Solr to enforce the authorization rules defined in the repository
5. Enforce ACLs on binary files
6. More documentation
7. Support external ACLs (ACLs not managed by fedora)
8. Add support for agentClass graphs defined within F4
9. Add support for agentClass graphs defined external to F4
10. Verify header-based (delegated) authentication is supported (where headers are used to define the effective agent, independent of any container-based AuthN)
11. Support for inclusion of other ACLs via acl:include
12. Fix bug with versioned resources: 

    Jira
    server DuraSpace JIRA serverId c815ca92-fd23-34c2-8fe3-956808caf8c5 key FCREPO-1760

Related Documents

• https://www.w3.org/wiki/WebAccessControl
• https://github.com/duraspace/pcdm/wiki#webacl
• Authorization Delegates
• http://www.w3.org/ns/auth/acl

...