To apply access rights at the property level, rather than to the whole item, you can use the property tag. A property tag can enclose any or all of the following child tags:

Example
<property name="yumminess">
  <descriptor-acl value="..."/>
  <acl-property name="yummy_acl"/>
  <creation-base-acl value="...
...
</property>
 
loading table of contents...