Access control list (ACL)

An access control list (ACL) is a mechanism for controlling authorization. It lists, for a given resource, which principals may access it and what permissions each one holds. An ACL is attached directly to the resource it protects — a file, a directory, a network resource — rather than to the principal.

Many file systems support ACLs as their access-control mechanism, including Windows NTFS and POSIX-compliant systems, where they extend the traditional owner/group/other permission model.

ACLs don’t scale well as the number of principals and resources grows. Granting or revoking access across many resources at once means editing many separate lists. This is one of the main motivations for role-based access control (RBAC), which assigns permissions to roles, and principles to roles, rather than applying permissions directly to principals.