anchor.diff:                      {ok, ?EACCES} ->
                           throw(?EACCES);
                       _ ->
  -                        {Acl, _} = get_acl(Uuid, AclMap),
  +                        Acl = get_acl(Uuid),
                           [{?traverse_container, NewSubjDoc, UserDoc, ShareId, Acl}]
                   end;
               _ ->
                   []
           end,
   
  -    {AncestorsCheck, CacheUsed} = expand_ancestors_check(Uuid, [], UserId, UserDoc, ShareId, AclMap),
  +    {AncestorsCheck, CacheUsed} = expand_ancestors_check(Uuid, [], UserId, UserDoc, ShareId),
       case {ShareId, CacheUsed} of
           {undefined, _} ->
               SubjectCheck ++ AncestorsCheck;
  
positive.code: -type check_type() :: owner % Check whether user owns the item
  | traverse_ancestors % validates ancestors' exec permission.
  | owner_if_parent_sticky % Check whether user owns the item but only if parent of the item has sticky bit.
  | write
  | read
  | exec
  | rdwr
  | acl_access_mask().
  
  -type acl_access_mask() :: binary().
  -type access_definition() :: root | {check_type(), item_definition()}.
  
  -export_type([check_type/0, item_definition/0, access_definition/0]).
  
  
negative.code: %%%===================================================================
  
  %%--------------------------------------------------------------------
  %% @doc
  %% annotation's before_advice implementation.
  %% #annotation.data type is [access_definition()] | access_definition()
  %% @end
  %%--------------------------------------------------------------------
  -spec before_advice(#annotation{data :: [access_definition()]}, module(), atom(), [term()]) -> term().
  before_advice(#annotation{data = AccessDefinitions}, _M, _F,
      [#sfm_handle{
          session_id = SessionId,
          file_uuid = FileUuid,
          share_id = ShareId
      } = Handle | RestOfArgs] = Args
  ) ->
      UserCtx = user_ctx:new(SessionId),
      UserId = user_ctx:get_user_id(UserCtx),
      ExpandedAccessDefinitions = expand_access_definitions(AccessDefinitions, UserId, ShareId, Args),
      [ok = rules:check(Def) || Def <- ExpandedAccessDefinitions],
      case (catch has_acl(FileUuid)) of
          true ->
              [Handle#sfm_handle{session_id = ?ROOT_SESS_ID} | RestOfArgs];
          _ ->
  