An access control list decides who gets to do what on your network or device

An access control list, or ACL, is a set of rules that says which people or devices can access a file, folder, printer, or network resource — and what they're allowed to do with it. Instead of giving everyone the same permissions, an ACL lets you be specific: one person can read a document but not change it, another can delete files, a third can't touch the resource at all.

Think of it like a guest list at a venue with different access levels. One person gets in and can go anywhere. Another gets in but only to the main room. A third isn't on the list at all. An ACL is that list, plus the rules about what each person can do once they're in.

ACLs exist on almost every device and network you use — Windows computers, Mac computers, Linux servers, network switches, cloud storage, and file-sharing systems all rely on them. You've probably changed one without realizing it: when you right-click a folder on Windows, click Properties, go to the Security tab, and change who can read or modify the contents, you're editing an ACL.

Key Takeaways

  • An access control list is a set of rules that determines which users or devices can access a resource and what actions they can perform on it.
  • Each rule in an ACL specifies a user or group, the resource they're accessing, and the permission level — read, write, delete, execute, or a combination.
  • ACLs are the reason you can share a document with one person for viewing only while another person can edit it, and a third person sees nothing.
  • Most operating systems let you change ACLs through a graphical interface without needing to understand the technical details underneath.

How an ACL actually works on your computer

When you try to open a file or folder, your operating system checks the ACL attached to that resource. It looks up your username or the group you belong to, finds the rule that matches you, and either grants or denies the action you're trying to perform.

Each rule in an ACL contains three pieces of information: who (a specific user or a group of users), what resource (a file, folder, or device), and what permission (read, write, delete, execute, or some combination). If you're not listed in the ACL at all, you get no access. If you're listed but only with read permission, you can open the file but not change it.

On a Windows computer, you see this when you right-click a folder, select Properties, and click the Security tab. The names you see there are the users and groups with access. The checkboxes below — Full Control, Modify, Read & Execute, List Folder Contents, Read, Write — are the permissions. On a Mac, the same concept appears in Get Info under Sharing & Permissions. On a network, a server administrator sets up ACLs to control which computers can connect and what they can do once connected.

The difference between ACLs and other permission systems

ACLs are one way to control access, but not the only way. Some systems use role-based access control, where you're assigned a job title or role — like "manager" or "intern" — and that role comes with a set of permissions. Others use attribute-based access control, which makes decisions based on characteristics like time of day, location, or device type. But ACLs are the most common and the most direct: they're a straightforward list of who can do what.

The key difference is flexibility. An ACL lets you give one specific person permission to do one specific thing. A role-based system is faster to set up when you have many people with the same job, but it's less precise. If you need to let one accountant see the budget spreadsheet while keeping it hidden from everyone else in the accounting department, an ACL is what you use.

Where you encounter ACLs in everyday use

When you share a Google Drive document and choose "Viewer" or "Editor", you're creating an ACL rule. When you upload a file to Dropbox and set it to "Anyone with the link can view", that's an ACL. When your workplace IT department tells you that you can access the payroll server but not the HR database, they've set up ACLs on both.

On your home network, your router has an ACL that controls which devices can connect to your Wi-Fi and what they can do once connected. Some routers let you block specific devices or limit bandwidth per device — those are ACL rules. If you've ever set up a printer so that only certain computers in your house can print to it, you've configured an ACL.

Cloud services use ACLs constantly. Amazon S3 buckets, Microsoft Azure storage, and Google Cloud Storage all rely on ACLs to determine which accounts can read, write, or delete files. When a company stores sensitive data in the cloud, the ACL is what keeps it away from employees who shouldn't see it.

Why ACLs matter for security and privacy

An ACL is one of the main tools that keeps your data private. Without ACLs, every file on a shared computer would be readable and writable by everyone with access to that computer. With ACLs, you can store sensitive documents on a shared drive and make sure only the people who need them can see them.

For businesses, ACLs are essential. A company might store customer data, financial records, and employee information on the same server. ACLs make sure the customer service team can see customer data but not payroll, the accounting team can see financial records but not customer data, and the HR team can see employee information but not customer data. If someone leaves the company, IT can remove their name from the relevant ACLs in minutes, and they lose access to everything when ready.

ACLs also create an audit trail. Most systems log who accessed what and when. If a file goes missing or data is leaked, the ACL and the logs can show exactly who had permission to access it and whether they actually did. This is why companies take ACLs seriously — they're not just about convenience, they're about accountability.

Common ACL permissions and what they mean

Different systems use different permission names, but the core permissions are consistent. Read means you can open and view the file or folder. Write means you can create, change, or delete files inside it. Execute means you can run a program or script. Delete means you can remove the file or folder entirely. Full Control or Owner means you can do all of the above and also change the ACL itself — decide who else gets access.

On a shared folder, you might see "Read & Execute" as a single permission, which means someone can open files and run programs but not change anything. On a cloud service, you might see "View", "Comment", and "Edit" instead of the technical names. The concept is the same: each permission level grants a specific set of actions.

Some systems also have Deny rules, which explicitly block access even if another rule would grant it. This is useful when you want to give a group of people access to a folder but exclude one specific person. Instead of removing them from the group, you add a Deny rule for them on that folder.

How to change an ACL on your own device

On Windows, right-click the file or folder, select Properties, click the Security tab, and click Edit. You'll see a list of users and groups with access. To add someone, click Edit, then Add, type their username, and click Check Names. Once they appear in the list, click their name and check the boxes for the permissions you want to give them. Click explore and OK when you're done.

On a Mac, select the file or folder, press Command-I to open Get Info, scroll down to Sharing & Permissions, and click the lock icon to unlock it. You'll see a list of users. Click the plus sign to add someone, select their name from the list, and use the dropdown menu to set their permission level to Read Only, Read & Write, or Write Only. Click the lock icon again to lock it when you're finished.

On a network drive or cloud service, the process varies. Most cloud services have a Share button that opens a dialog where you type an email address and choose a permission level. Network drives usually require you to contact your IT department, because changing ACLs on shared resources can affect many people at once.

Frequently Asked Questions

Can I see the ACL on a file I don't own?

On most systems, yes — you can see who has access to a file, but you can't change the ACL unless you have Full Control or Owner permission. This is intentional: it lets you know whether you're allowed to access something, but prevents you from accidentally changing permissions you shouldn't touch.

What happens if I'm not listed in an ACL at all?

You get no access to that resource. You can't read it, write to it, or do anything with it. Some systems show you a "Permission Denied" error. Others straightforward don't show you the file or folder in the first place, as if it doesn't exist.

Can an ACL rule explore to a group instead of a single person?

Yes, and this is common in workplaces. Instead of adding each accountant individually to a folder's ACL, IT creates a group called "Accounting" and adds that group to the ACL once. When a new accountant joins, IT adds them to the Accounting group, and they automatically get access to all folders that group can access.

Do I need to understand ACLs to use my computer?

No. Most of the time, ACLs work in the background and you don't think about them. You only need to understand them if you're sharing files with others, managing a network, or trying to troubleshoot why you can't access something you think you should be able to access.

Can someone change an ACL to give themselves access to a file they're blocked from?

Only if they have Full Control or Owner permission on that file. If they don't, they can't change the ACL. This is why ownership and Full Control are powerful permissions — whoever has them can lock everyone else out or let everyone in. Most systems restrict who can grant Full Control to prevent abuse.