A set of rules specifies which users, systems, or processes are granted access to a particular resource, and what operations they’re allowed to perform on it. In practice, an ACL acts as a gatekeeper: each rule pairs an identity (a user, group, device, or IP address) with a set of permissions (such as read, write, execute, or deny), and the system consults that list every time someone requests access.
How ACLs Work
When a request to access a resource comes in, the system checks it against the ACL entries, often called access control entries (ACEs), one at a time. Each entry answers two questions: who is asking, and what are they allowed to do? If a matching rule grants the requested permission, access is allowed; if a rule explicitly denies it, or if no rule matches, access is refused. Many systems evaluate rules in order and stop at the first match, which means the sequence of entries can change the outcome. This makes rule ordering an important part of ACL design. A single entry typically contains a subject (the identity being governed), a resource or object, and the applicable permissions. Some ACLs also support deny rules that override grants, giving administrators fine-grained control over exceptions.
Common Types of ACLs
- Filesystem ACLs: Control access to files and directories. They extend the traditional owner/group/others permission model found in operating systems, letting administrators grant specific rights to individual users or groups. Windows NTFS permissions and POSIX ACLs on Linux and Unix are the most familiar examples.
- Networking ACLs: Configured on routers, switches, and firewalls to filter traffic. They decide which packets are allowed to enter or leave a network based on criteria such as source and destination IP addresses, port numbers, or protocols. Standard ACLs filter on source address alone, while extended ACLs can evaluate multiple attributes for more precise control.
- Application and cloud ACLs: Govern access to resources within software systems, such as database records, API endpoints, storage buckets, and objects, in a cloud environment. Cloud platforms often combine ACLs with broader identity and access management (IAM) frameworks.
ACLs vs. Role-Based Access Control
ACLs are sometimes contrasted with role-based access control (RBAC). An ACL attaches permissions directly to resources, listing exactly who can do what to each object. RBAC instead assigns permissions to roles, and users inherit those permissions by being assigned to a role. ACLs offer very granular, object-level control, which is powerful but can become hard to manage at scale as the number of resources and users grows. RBAC is often easier to administer in large organizations, and many systems use the two approaches together.
Best Practices
Effective ACL management starts with least privilege: grant the minimum permissions required, then expand only when justified. Prefer assigning permissions to groups rather than individuals, so access is easier to review and update. Order rules carefully, especially in first-match systems, and place more specific rules ahead of broader ones. Finally, audit ACLs regularly to remove stale entries and outdated permissions, which tend to accumulate over time and quietly widen access.
Additional Acronyms for ACL
- ACL - Agent Communication Language
