An access control entry is a single rule that says who can do what with a file or folder

An access control entry (ACE) is one line in a permission list. Think of it like a single rule on a guest list: "Sarah can read the documents folder" or "The accounting team can edit the budget spreadsheet." Each entry pairs a person or group with a specific action — read, write, delete, execute — on a specific file or folder. Your operating system checks these entries every time someone tries to open or change something.

You probably interact with access control entries without knowing the term. When you right-click a file in Windows, choose Properties, go to the Security tab, and see a list of names with checkboxes next to "Read," "Modify," and "Full Control," you are looking at access control entries. On a Mac, when you click the lock icon in a file's Get Info window and see "Read & Write" or "Read Only" next to a person's name, that is an access control entry too.

Key Takeaways

  • An access control entry is one permission rule — it connects a person or group to one action on one file or folder.
  • Multiple entries stack together to form an access control list, which is the complete set of who can do what.
  • Entries can allow or deny an action, and a deny entry always wins if both exist for the same person.
  • Your operating system checks entries in order every time someone tries to access a file, so the order and overlap between entries matters.

How an access control entry connects to the bigger permission system

A single access control entry is useless on its own. It lives inside an access control list (ACL), which is the complete set of rules for one file or folder. If you have a spreadsheet, its ACL might contain five entries: one saying "You can read and write," one saying "Your manager can read and write," one saying "The finance team can read only," one saying "Contractors cannot access this at all," and one saying "The system administrator can do anything." Each of those is one entry.

When someone tries to open the file, the operating system walks through the list in order, checking each entry until it finds one that applies to that person. If it finds a match, it grants or denies the action based on what that entry says. If an entry says "deny," that stops the check when ready — a deny always overrides an allow, even if another entry would have said yes.

The difference between allow and deny entries

Most access control entries you see are allow entries — they say "this person can do this." But entries can also be deny entries, which explicitly forbid an action. A deny entry is stronger. If you have an allow entry saying "Everyone in the company can read this file" and a deny entry saying "Bob cannot read this file," Bob cannot read it. The deny wins.

Deny entries exist because sometimes it is easier to give broad permission and then carve out exceptions. A hospital might say "All staff can access patient records" and then add deny entries for specific staff members who should not. A software company might say "All developers can edit the code repository" and then deny access to a contractor who is leaving. Without deny entries, you would have to list every single person individually in allow entries, which gets unwieldy fast.

Where you actually see access control entries

On Windows, access control entries appear in the Security tab of any file or folder's Properties. Right-click the file, choose Properties, click the Security tab, and click Edit. You will see a list of users and groups, and when you click one, checkboxes appear showing what that entry allows or denies. Each row is one entry.

On a Mac, open a file's Get Info window (Command-I), scroll to Sharing & Permissions at the bottom, and click the lock to edit. Each row showing a person's name and their permission level (Read & Write, Read Only, Write Only, or None) is one entry. Linux systems use similar logic but display it differently depending on the file manager you use.

In cloud storage like Google Drive or OneDrive, when you share a file and set someone to "Viewer" or "Editor," you are creating an access control entry. The entry says "this person can do this action on this file." If you share the same file with five people at different permission levels, that file has five entries in its access control list.

Why the order of entries matters in some systems

In Windows and some other systems, the order of access control entries in the list actually matters. The system checks entries from top to bottom and stops as soon as it finds one that applies. This means if you have an allow entry at the top and a deny entry below it, the allow wins because the system never reaches the deny. If you flip the order, the deny wins.

This is why IT administrators sometimes have to reorder entries to get the permission they want. If a deny entry is buried at the bottom of a long list, it might never be checked because an allow entry higher up already matched. Most modern systems try to avoid this confusion by putting all deny entries first, so they are always checked first, but not all systems follow this rule.

What happens when you change a file's permissions

When you change who can access a file, you are adding, removing, or modifying access control entries. If you right-click a file, choose Properties, go to Security, click Edit, and add a new user with Read permission, you are creating a new entry. If you remove a user from the list, you are deleting their entry. If you change someone from "Read Only" to "Read & Write," you are modifying their existing entry.

These changes take effect when ready on most systems. The next time that person tries to access the file, the operating system checks the updated list of entries and grants or denies access based on what is there now. This is why removing someone from a shared file works right away — their entry is gone, so they no longer match any rule that would let them in.

Frequently Asked Questions

Can I have multiple access control entries for the same person?

Technically yes, but it is unusual and confusing. Most systems let you have one entry per person or group. If you need to give someone different permissions for different actions, you modify their single entry to allow or deny each action separately. Having two entries for the same person creates ambiguity about which one the system should check first.

What does "inherit" mean when I see it in permissions?

Inheritance means a file or folder automatically gets the same access control entries as its parent folder. If you put a folder inside another folder and set permissions on the parent, the child inherits those entries unless you explicitly break the inheritance. This saves time — you do not have to set permissions on every single file individually.

If I delete an access control entry, does the person lose access when ready?

Yes. The moment you remove the entry, that person no longer has a rule that allows them access. The next time they try to open the file, the system checks the list, finds no entry for them, and denies access. If they already have the file open, they can keep using it, but they cannot reopen it.

Why would I use a deny entry instead of just not giving someone permission?

Deny entries are useful when you want to block one person or group while allowing a broader group. If you say "Everyone in the department can read this," you could add a deny entry for one person instead of removing the whole department and listing everyone individually. Deny is also explicit — it documents that you intentionally blocked someone, not that you forgot to add them.