DocumentationExperience Cloud KCS

Managing ACL and ACE node deletion in Adobe Experience Manager

Last update: August 27, 2026

This article explains whether ACL (rep:ACL) nodes can be deleted through the /bin/policies endpoint in Adobe Experience Manager and outlines best practices for managing access control entries (ACEs) and access control lists (ACLs).

Description description

Environment

Adobe Experience Manager (AEM) (all versions)

Issue/Symptoms

  • ACE nodes (rep:GrantACE and rep:DenyACE) can be deleted through the /bin/policies endpoint.
  • Administrators need to determine whether ACL nodes (rep:ACL) can also be deleted through the same endpoint.

Cause

The /bin/policies endpoint manages ACE entries within an ACL node. It does not delete the ACL node itself. Deleting ACL nodes directly is not a standard or recommended operation and can lead to repository inconsistencies.

Resolution resolution

Follow these steps to resolve the issue:

  1. To remove permissions for a user or group, use the /bin/policies endpoint or the appropriate AEM API to delete individual ACE nodes (rep:GrantACE or rep:DenyACE) from the ACL (rep:ACL) node.
  2. Remove all required ACE entries from the ACL node through the AEM user interface or programmatically by using supported APIs.
  3. After you remove all ACEs, allow the repository implementation to clean up the rep:ACL node. You do not need to delete the ACL node manually in most cases.
  4. Do not delete rep:ACL nodes directly through CRX/DE or repository tools unless the official documentation explicitly recommends it. Direct deletion can cause repository inconsistencies.
  5. For more information about permissions and access control in AEM, review the official Adobe Experience Manager documentation.
recommendation-more-help
experience-cloud-kcs-help-kbarticles