JcrMetadataAccess.commit appears to always be running as ADMIN, and thus it never can checkPermissions as the logged in user.