Some time ago, Till told me the Stud.IP Opencast plugin
would only manage episode's ACLs relevant to Stud.IP
where in fact, the plugin would remove ACLs from events
granting permissions in secondary LMSes or other uses.

This approach checks if an existing Opencast ACL is
managed by Stud.IP (hex_Learner/hex_Instructor/
ROLE_ADMIN/ROLE_ANONYMOUS), and if not, it would add
those again to the list of ACLs and check again,
if the list of ACLs sent by Opencast differs from
the list of ACLs to be set.