Stefan,  when you look at the following class:

package org.jboss.security.acl.ACLImpl

we have

import javax.persistence.OneToMany;
import org.hibernate.annotations.Cascade;

   @OneToMany(mappedBy = "acl", fetch = FetchType.EAGER, cascade =
   {CascadeType.REMOVE, CascadeType.PERSIST})
   @Cascade(
   {org.hibernate.annotations.CascadeType.DELETE_ORPHAN})
   private Collection<ACLEntryImpl> entries;

We have two annotations on the collection of acl entries. One is a JPA annotation and the other is an Hibernate specific annotation.

The question I have is the hibernate annotation a necessity? If not, we just have a JPA dependence on the ACL implementation.