create service user sling-installer-provider-jcr with path system/sling

set principal ACL for sling-installer-provider-jcr
    allow   jcr:read    on /
    allow   rep:write   on /apps/sling/install
end

create path (sling:Folder) /apps/sling/install