Alex Deparvu, just ran into an NPE when adding an ACE including some restriction. The reason is a tiny bug in the ACL implementation that mistakenly uses the oakName to retrieve the value/values from the passed restriction map. It should obviously use the key of the map, which corresponds to the jcrName. in other words: the bug only shows up when running tests with re-mapped namespaces.
proposed fix attached. will attach a test case illustrating the issue later on.