public function createAcl(): WebAcl {
        $resMeta = $this->res->getMetadata(true);
        $acls    = $resMeta->allResources(self::ACL_LINK_PROP);
        if (count($acls) > 1) {
            throw new RuntimeException('Resource has many ACLs');
        } else if (count($acls) > 0) {
            return $this;
        }

        try {
            $location = RC::get('fedoraAclUri');
        } catch (InvalidArgumentException $ex) {
            $location = '/';
        }

        $aclMeta = (new Graph())->resource('.');
        $aclMeta->addType(self::ACL_CLASS);
        $aclMeta->addLiteral(RC::titleProp(), 'ACL');
        $id      = preg_replace('|^[^:]+|', 'acl', $this->res->getUri(true));
        $aclMeta->addResource(RC::idProp(), $id);

        // Link to ACL is applied after the transaction commit, so we need 
        // a separate transaction not to affect the current one
        // As a side effect the resource for which an ACL is created has to 
        // persistently exist in the repository already!
        $fedoraTmp = clone($this->res->getFedora());
        $fedoraTmp->__clearCache();
        $fedoraTmp->begin();
        $aclRes    = $fedoraTmp->createResource($aclMeta, '', $location, 'POST');
        $resMeta->addResource(self::ACL_LINK_PROP, $aclRes->getUri(true));
        try {
            $resTmp = $fedoraTmp->getResourceByUri($this->res->getUri());
            $resTmp->setMetadata($resMeta);
            $resTmp->updateMetadata();
            $fedoraTmp->commit();
        } catch (NotFound $e) {
            $fedoraTmp->rollback();
        }

        //sleep(1); //TODO
        $this->res->getMetadata(true);
        if ($this->res->getAclUrl() !== $aclRes->getUri(true)) {
            // second try for binary resources which are not handled properly by Fedora
            if ($this->res->getAclUrl(true) !== $aclRes->getUri(true)) {
                throw new RuntimeException('ACL creation failed');
            }
        }

        foreach ($this->resRules as $h => $i) {
            $i->move($aclRes->getUri(true) . '/' . $h);
        }

        return $this;
    }