...

In order to enforce policies, your authorization delegate must figure out what to do when asked for certain permissions. In some cases more than one permission is requested of the authorization delegate in order to complete to the overall ModeShape operation. In addition, some Fedora operations, such as object Container creation, involve several ModeShape operations. All of the ModeShape operations that compose a Fedora API call are performed in a single session with one save point and will succeed or fail together.

...

Roles-Aware Authorization Delegates

There is a convenience convenient abstract class for those implementing policy enforcement points that need to be aware of access roles. If you subclass this Extending the AbstractRolesAuthorizationDelegate class , then your implementation can be reduced to can mean having to write only a single method.