If you attempt to just fiddle around with the PageData's
ACL property inside events like
PublishedPage and then run
Save() you will simply get a huge yellow screen of death telling you that Cannot save ACL with no page link set. This could be due to a page provider not properly setting PageLink.
Since this behaviour is neither intuitive (I mean, you get the PageData object after it's saved/published in the event handler) nor documented anywhere, I'm sharing the solution to the problem here. And it's really quite simple:
The following will not work:
EPiServer: Since this is not really intuitive behaviour, this should be documented either in tutorials somewhere or in the SDK.