Thank you John,

i don't know if i do not understand or there is a bug or misconfiguration somewhere:

I just found a warning from the google search console, saying that 3 links submitted into the sitemap are not accessible and provide a 404.
I check the link and it is true, so i went to check the article and i found our that, in this single case, the article has "public" permission but it is "not published"

So to me it looks like that the sitemap is ignoring the ACL.