title: How to use class-scope aces in Symfony2?
body: <p>I've got a problem with class-scope aces. I've created an ace for a
  class like this :</p>
  
  <pre><code>$userIdentity = UserSecurityIdentity::fromAccount($user);
  $classIdentity = new ObjectIdentity('some_identifier', 'Class\FQCN');
  $acl = $aclProvider-&gt;createAcl($classIdentity);
  $acl-&gt;insertClassAce($userIdentity, MaskBuilder::MASK_CREATE);
  $aclProvider-&gt;updateAcl($acl);
  </code></pre>
  
  <p>Now, I'm trying to check the user's permissions. I've found this way
  of doing things, which is not documented, but gives the expected
  results on a class basis :</p>
  
  <pre><code>$securityContext-&gt;isGranted('CREATE', $classIdentity);  // returns true
  $securityContext-&gt;isGranted('VIEW', $classIdentity);    // returns true
  $securityContext-&gt;isGranted('DELETE', $classIdentity);  // returns false
  </code></pre>
  
  <p>This method is well adapated to the "CREATE" permission check, where
  there's no available object instance to pass to the method. However,
  it should be possible to check if another permission is granted on a
  particular instance basis :</p>
  
  <pre><code>$entity = new Class\FQCN();
  $em-&gt;persist($entity);
  $em-&gt;flush();
  $securityContext-&gt;isGranted('VIEW', $entity);  // returns false
  </code></pre>
  
  <p>This is where the test fails. I expected that an user who has a given
  permission mask on a class would have the same permissions on every
  instance of that class, as stated in the documentation ("The
  PermissionGrantingStrategy first checks all your object-scope ACEs if
  none is applicable, the class-scope ACEs will be checked"), but it
  seems not to be the case here.</p>