I'm using this module with MetaData Roles for authorizing the render action on components.
Because the ActionPermissions class access modifier is package, it can only be used in the same package. If you need to override MetaDataRoleAuthorizationStrategy isActionAuthorized method, you cannot do that in any other package because the metadata key is package and you cannot see it from anywhere else.
I ended up copy pasting the whole MetaDataRoleAuthorizationStrategy and ActionPermissions classes instead of extending them.
The fix should simply change access to ActionPermissions to public. InstantiationPermissions is public, I don't see why ActionPermissions can't be