an access-control list
/ ACL, said "A-C-L" or "ackle" /
The simple owner/group/other permissions are like a club with exactly three membership tiers, fine until you need to say "let Bob in, keep Carol out, and give Dana read-only," all as named individuals. An access-control list (ACL) is the per-file guest list that makes that possible. It attaches to a file a list of specific users or groups, each paired with exactly the rights they are allowed.
Where the classic scheme offers only three buckets, an ACL stores arbitrarily many entries directly with the file's metadata. Each entry names a subject (a particular user or group) and the operations that subject may perform (read, write, execute, and on richer systems finer rights like delete or change-permissions). When a process requests an action, the OS scans the file's ACL for an entry matching the requesting user or its groups and decides accordingly, often with deny entries taking precedence so a single explicit denial can override broader grants. This is precisely the controlled-access model: a clear, checkable statement of exactly who may do what, expressed per file.
Why it matters: ACLs give fine-grained, individual control that the three-class model simply cannot express, which is why most modern systems (Windows NTFS, and Unix-like systems via extended ACLs) support them. The honest trade-off is complexity and maintenance: long ACLs scattered across thousands of files become hard to audit, and a single misplaced grant can quietly open a hole. This is why ACLs are best used in line with the principle of least privilege, give each subject only the access it genuinely needs, and no more, rather than handing out broad rights because it is convenient.
A budget file might carry an ACL like: owner alice full control; user bob read+write; group accounting read; user carol explicitly denied. The three-bit scheme could never name bob and carol individually like this; the ACL can.
A per-file list of named subjects, each with exactly the rights they get.
ACLs add precision but also maintenance cost, long lists across many files are hard to audit and easy to misconfigure. Apply least privilege: grant only what each subject actually needs.