ACLs are exposed in the web-client via the Manage Space Users and Manage Content Users actions. Users/groups are invited/removed from the list of authorities for a space and the inheritance of parent permissions can be modified.
The repository features a PermissionService Java API for full access to the ACL implementation - which includes Allow, Deny and Inherit. Permissions are at the Node level - so a document can inherit or have separate permissions from the parent folder node etc.
The permissions API is also accessable through the JavaScript scripting interface so can you construct rules and actions that setup and modify permissions on folders and documents if required.