diff --git a/docs/modules/ROOT/pages/servlet/appendix/database-schema.adoc b/docs/modules/ROOT/pages/servlet/appendix/database-schema.adoc
index 39c205bb77c..fb34fbe34ba 100644
--- a/docs/modules/ROOT/pages/servlet/appendix/database-schema.adoc
+++ b/docs/modules/ROOT/pages/servlet/appendix/database-schema.adoc
@@ -370,6 +370,33 @@ BEGIN
 END;
 ----
 
+[[dbschema-acl-class-id-type]]
+=== UUID and String Object Identities
+By default, the ACL module expects the identifier of a domain object (`object_id_identity`) to be a `Long`.
+To use non-Long identifiers, such as `UUID` or `String`, add the optional `class_id_type` column to the `acl_class` table:
+
+[source,ddl]
+----
+create table acl_class(
+	id bigint generated by default as identity(start with 100) not null primary key,
+	class varchar_ignorecase(100) not null,
+	class_id_type varchar_ignorecase(100),
+	constraint unique_uk_2 unique(class)
+);
+----
+
+The column stores the fully qualified class name of the identifier type, such as `java.util.UUID`.
+Since reading and writing this column is disabled by default, you must also enable it on both `BasicLookupStrategy` and `JdbcMutableAclService`:
+
+[source,java]
+----
+basicLookupStrategy.setAclClassIdSupported(true);
+jdbcMutableAclService.setAclClassIdSupported(true);
+----
+
+The ACL artifact JAR contains a complete HyperSQL schema with this column in the `createAclSchemaWithAclClassIdType.sql` file.
+For other databases, add the `class_id_type` column to the corresponding `acl_class` definition shown in the preceding sections.
+
 [[dbschema-oauth2-client]]
 == OAuth 2.0 Client Schema
 The JDBC implementation of xref:servlet/oauth2/client/core.adoc#oauth2Client-authorized-repo-service[ `OAuth2AuthorizedClientService`] (`JdbcOAuth2AuthorizedClientService`) requires a table for persisting `OAuth2AuthorizedClient` instances.