A single rule within an Access Control List (ACL) that defines the access rights of a specific identity to a particular resource. If an ACL is the full list of who can do what to an object, an ACE is one line on that list, pairing an individual user, group, device, or system with the permissions it's granted or denied.
How ACEs Work
Each ACE contains a few core pieces of information: a subject (the identity the rule applies to, such as a user account, group, or security identifier), a set of permissions (like read, write, execute, delete, or modify), and a type that determines whether those permissions are allowed or denied. Some ACEs also carry inheritance flags that control whether the rule propagates to child objects, such as files inside a directory. When a subject requests access to a resource, the system walks through the ACEs in the resource's ACL and evaluates them against the request. In many systems, entries are processed in order, and the first matching ACE decides the outcome, which is why the arrangement of ACEs within an ACL directly affects behavior. Deny entries are commonly evaluated before allow entries so that an explicit denial can't be bypassed by a later grant.
- Deny entries: Useful for creating exceptions by blocking specific permissions for a subject.
- Inheritance flags: Control whether the rule propagates to child objects, such as files inside a directory.
Allow and Deny Entries
ACEs generally fall into two categories. An allow (or access-allowed) entry grants the specified permissions to its subject. A deny (or access-denied) entry explicitly blocks those permissions. Deny entries are useful for creating exceptions: an administrator can grant broad access to a group through one ACE, then add a deny ACE to exclude a particular member without restructuring the entire list. Because a single deny can override multiple grants, deny entries are powerful and should be used deliberately.
ACEs in Practice
On Windows systems, ACEs are the building blocks of NTFS and Active Directory security descriptors. Each ACE references a security identifier (SID) and an access mask that encodes the specific rights being granted or denied. On Linux and Unix systems using POSIX ACLs, each entry maps a user or group to a permission set (read, write, execute), extending the traditional owner/group/others model with entries for named users and groups. In networking, the individual rules that make up a router or firewall ACL are effectively ACEs, each permitting or denying traffic based on attributes such as source address, destination address, or port number.
Best Practices
Keep entries as specific as possible, and favor granting permissions to groups rather than individual users so the list stays manageable. Pay close attention to ordering in first-match systems, placing deny entries and more specific rules ahead of broad grants. Use inheritance flags intentionally, since a single ACE on a parent object can silently shape access across many child resources. And review ACEs periodically to remove stale or redundant entries, which tend to accumulate and quietly expand access over time.
