An Access Control List (ACL) is a set of ordered rules that decide who or what is allowed to do something, and who is not. In networking it is a list that filters packets on routers, switches and firewalls using fields such as source and destination IP address, protocol and port. Rules are read from top to bottom and the first match wins. There is usually an implicit deny at the end, so anything not matched is blocked. Basic or standard lists match only on source address, while extended lists match on more fields, which gives finer control. Classic device ACLs are stateless, so every packet is checked on its own, and they are often combined with stateful inspection that tracks connections. Variants exist for different places in the path, such as VLAN ACLs, interface ACLs and cloud network ACLs, while cloud security groups are policy lists tied to workloads even if the name is different. In operating systems and storage, an ACL defines which users and groups can read, write or execute a file or object, extending simple owner and group permissions with per-entry rights. Each individual rule is an Access Control Entry that either permits or denies a subject or a traffic match. Because order matters, small mistakes can open or block more than intended, so ACLs are usually documented with comments, hit counters and change control to keep behaviour clear.
