Is a type of ACL that controls who can access an object.
It contains ACEs that grant or deny permissions for Security Principals.
It is evaluated by the system during during an access check, if no ACE allows the requested operation, then it’s denied.