DataTerminology.comNEW
Also known as: ACL
A list that specifies which principals are granted or denied permissions on a resource.
DESCRIPTION
An Access Control List is a per-resource table of access control entries that map principals (users, groups, services) to permissions. ACLs implement discretionary or object-specific access decisions in operating systems, file systems, networks, and applications. They enable fine-grained control but can become complex and error-prone at scale. Alternatives like RBAC or ABAC centralize policies or abstract them into roles and attributes. Good ACL hygiene includes least privilege, inheritance control, and regular audits.
ALTERNATIVE DEFINITIONS
Wikipedia
An access-control list (ACL) is a list of permissions associated with an object.
Defines ACLs generically across systems as object-associated permission lists.
NIST Computer Security Resource Center
Access Control List (ACL): A list of permissions that specify which users or system processes are granted access to objects, as well as what operations are allowed on given objects.
Highlights operations allowed per principal and object.
RELATED TERMS
Identity Management Permissions Least Privilege Policy-Based Access Control Audit Logging OAuth 2.0 SAML Directory Service
COMPETING TERMS
RBAC Attribute-Based Access Control
RELATIONS
- Broader: List
KNOWLEDGE AREAS
Data Security Software Engineering Infrastructure
TARGET AUDIENCE
DevOps Engineer Cloud Architect Software Developer Data Engineer Chief Information Officer
EXTERNAL SOURCES
- Wikipedia - Access-control list
- NIST - NIST glossary definition of ACL
- Microsoft - Windows access control and ACLs
- Linux Man Pages - Linux filesystem ACL manual
TOP QUESTIONS
When should Access Control Lists be used?
Use ACLs for fine-grained, object-level permissions where role abstraction is insufficient. For large-scale systems, combine with RBAC policies for manageability.
Category: Practice
What are the risks of misconfigured Access Control Lists?
Overly permissive or conflicting entries can expose sensitive data. Complexity increases error likelihood without audits and inheritance management.
Category: Risks
How do Access Control Lists compare to RBAC?
ACLs assign permissions directly to principals per object; RBAC grants permissions through roles. RBAC scales better for organizations.
Category: Alternatives
What is an Access Control Entry in an ACL?
An ACE is a record in an ACL specifying a principal, allowed or denied permissions, and optional inheritance flags.
Category: Concept
How do network ACLs differ from filesystem ACLs?
Network ACLs control traffic rules at subnets or interfaces; filesystem ACLs control object permissions for files and folders.
Category: Concept
What is a common ACL mistake?
Using deny entries excessively, which complicates evaluation and can override intended allow entries.
Category: Mistakes
How are Access Control Lists audited?
Regularly export and review ACLs, use policy-as-code, and enforce change approvals. Monitor access logs for anomalies.
Category: Management
Do Access Control Lists support inheritance?
Many systems support inheritance, where child objects derive permissions from parents. Control inheritance carefully to avoid unintended access.
Category: Concept
What standards relate to Access Control Lists?
NIST guidance and POSIX ACLs inform implementations. Modern systems may integrate ACLs with policy engines like OPA.
Category: Standard