ACL just consists of one ACE -- it should be a list of ACEs

The schema should look like this:

<xs:complexType name="cmisAccessControlListType">
<xs:sequence>
<xs:element name="permission" type="cmis:cmisAccessControlEntryType" minOccurs="1" maxOccurs="unbounded" />
<xs:any namespace="##other" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>