While the WebAC spec requires that the objects of acl:agent statements be URIs, the current (4.7.5) Modeshape implementation of Fedora allows string literals as the objects of of acl:agent statements. In addition, internally, the implementation does all of its agent comparisons assuming the agent is a simple string username, and not a full URI. This was done to facilitate easier integration with existing authentication systems (e.g., LDAP) that only provide a username and not a URI.
...