Home / Knowledge hub / Access control list
Knowledge hub
Access control list
A list on a resource naming who may read, write or change it.
What it means
An access control list, or ACL, is a list attached to a resource that says which people, groups or services may do what to it. A file might have entries such as: Priya can read, the finance group can edit, everyone else is refused.
It answers the question from the resource's side. Rather than a user carrying a set of permissions, each item carries the list of who may touch it, which makes sharing individual items easy. It is the model behind file sharing, cloud storage permissions and many collaboration features.
Why it matters
ACLs are flexible and so easy to get wrong. Each item has its own list, which means a thousand items have a thousand separate decisions. One careless entry that grants "anyone with the link" or "all signed-in accounts" can expose a single customer's data without any change to your code.
They also drift. People are added for a project and never removed, and defaults are copied from one place to another. Public cloud storage buckets exposed by a loose ACL are a regular source of data breaches, covered under S3 bucket exposure.
How it shows up
You meet ACLs in file systems, cloud storage, network devices and in products that let customers share documents, projects or boards. Inside your app, a sharing table is an ACL, and every read of an item should check it on the server. A missing check is an IDOR waiting to be found.
Look at the defaults for new items, check what happens when the list is empty, and compare who the screen says has access with what the data actually allows. Avoid broad group entries and wildcards. Review them on a schedule with an access review so stale entries are removed.
Questions people ask
Access control list, answered
What is the difference between an ACL and RBAC?
An ACL lists who may use one resource. RBAC assigns permissions to roles that people hold. Many systems use both: roles for broad rights and ACLs for individual items.
What does an ACL entry contain?
Usually who it applies to, such as a user, group or service, and what they may do, such as read, write or delete. Some also allow explicit denies and conditions.
Why are ACLs risky at scale?
Because decisions multiply. Every item has its own list, so mistakes hide in the volume, and defaults or inherited entries can quietly grant more than anyone intended.
Can an ACL be bypassed?
If the application forgets to check it, yes. An item reached by a direct link, an export or a different API endpoint may skip the list. Test each path to the same data.
How do we test them?
Try reading, changing and deleting an item with an account not on its list, through each route that reaches it. A correct list refuses all three.
Related
Terms that sit next to this one
Access control
The rules deciding which person can see or do which thing in your app.
RBAC
Permissions attach to roles, and people are given roles.
IDOR
Changing an id in a request and getting back someone else's record.
Object-level authorisation
Checking access to each individual record, not only to the type of record.
S3 bucket exposure
A cloud storage bucket left open so anyone on the internet can read its files.
Who is on the list, really?
We test what one signed-in account can reach in another's data through each route to the same item, and each finding carries the request and response. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.