how does one create an Access Control Resource?

There is no mechanism for specifying how to create an Access Control Resource (ACR) attached to an ldp:Resource, in the WAC spec, as far as I can see.

acp:default allows one to state what a default ACR for a resource is, and the whole WAC inheritance algorithm says what one should do if a resource does not have an ACR: where to look for one. But it does not tell one how one creates an ACR for a resource.

One way to solve the problem is as ACP does: require that every resource has its own ACR. The acl:default can then be used to fill in the new ACR with the default access control rule. (And it would explain the old acl:defaultForNew name).

Without such a behavior the concept of acl:default does not quite make sense: for how would a client create an ACR to begin with, that could override the default? Link relations could only ever link to the ACR containing the default, and so one could not change the default.

One could perhaps think of allowing clients to POST content with a Link: ldp:AccessControl rel=type header to a resource to create one. Perhaps that is when default rules apply? Only users with control rights as default could create those resources?