From the documentation 15.3.2 Built-In Expressions :
Where myPermissionEvaluator is the bean which implements PermissionEvaluator. Usually this will be the implementation from the ACL module which is called AclPermissionEvaluator. See the "Contacts" sample application configuration for more details.
Looking into this sample, I see nothing dealing with that ...