Discuss that while a manager can work with a systems administrator to create managerial policy as described in the preceding section, the system administrator may need to create a policy to implement the managerial policy.
State the purpose and definition of access control lists (ACLs). Comment that these areuser access lists, matrices, and capability tables that govern the rights and privileges of users. A capability table specifies which subjects and objects users or groups can access; in some systems, capability tables are called user profiles or user policies.
Summarize the purpose of an ACL and what it regulates:
Who can use the system
What authorized users can access
When authorized users can access the system
Where authorized users can access the system from
Recall the purpose of configuration rule policies, as they are specific instructions entered into a security system that govern how it reacts to data it receives. Note that these are more specific than ACLs to the operation of a system and may or may not deal with users directly.