We can store each object with a list of pairs: (who, what access)
Unix’s ‘user’, ‘group’, ‘other’ permission bits are a limited ACL Full explicit ACLs can become large (when added up) and performance-sensitive (if checks are frequent).
The protect the object, at the object. Which means:
- easy to revoke permissions
- easy to understand and audit
However:
- scale can become a problem if there are many users, files, actions
- authority is ambient: based on who you are; we can’t delegate fine-grained access to some code or process