class RestrictedContextAfterInvocationProvider extends AbstractAclProvider {

    @Override
    public Object decide(Authentication authentication, Object secureObject, Collection<ConfigAttribute> attributes,
                         Object returnedObject) throws AccessDeniedException {
        if (returnedObject == null) {
            return null;
        }

        boolean isSupportAttribute = attributes != null && attributes.stream().anyMatch(this::supports);
        if (isSupportAttribute) {
            ExecutionContext context = getContextAsFirstArgumentOfSecureObject(secureObject);

            boolean isInaccessibleResource = isInaccessibleResource(returnedObject);
            boolean isRestrictedContextApplied = isRestrictedContextApplied(context, authentication, returnedObject);

            if (isInaccessibleResource && isRestrictedContextApplied) {
                throw new AccessDeniedException("Access is denied");
            }

            if (isRestrictedContextApplied) {
                ((Resource)returnedObject).accept(new HideRestrictedLocalResources());
            }
        }
        return returnedObject;
    }

      RestrictedContextAfterInvocationProvider(AclService aclService, String processConfigAttribute,
            List<Permission> requirePermission, List<Permission> ignoreRestrictedContextForPermission,
                Set<Class<? extends Resource>> inAccessibleResourceTypes, Set<Class<? extends Resource>> skipResourceTypes);

}