src/main/resources/sling-xss.txt

create service user sling-xss with path system/sling

set principal ACL for sling-xss
  allow   jcr:read    on /apps/sling/xss
  allow   jcr:read    on /libs/sling/xss
end

create path (sling:Folder) /apps/sling/xss
create path (sling:Folder) /libs/sling/xss