For auhorization, Jetspeed 2 implements its own java.security.Policy using a relation database store to manage associations between principals and permissions.
The PermissionManager provides access to the permissions associated to given principals.
PermissionManager implementation.