An Access Control Entry (ACE) is a single rule inside an Access Control List (ACL) that says who can do what to a resource. Each ACE names a security principal such as a user or group, often by Security Identifier (SID), specifies the permissions or rights, and marks whether they are allowed or denied. In Microsoft Windows there are Discretionary Access Control Lists (DACLs) that use ACEs to allow or deny access, and System Access Control Lists (SACLs) that use audit ACEs to log access attempts. ACEs can also include inheritance flags so permissions flow to child items like folders and files. The order of ACEs in an ACL matters because they are processed in sequence, with explicit denies typically evaluated before allows. Example: an ACE could allow a group read and write to a file, while another ACE denies delete for the same group.
