The conceptual module of ACL

The final piece of the non-web tier security puzzle is security at the business object level, applied at or below the business tier. Security at this level is implemented using a technique known as ACL, or ACLs. Summing up the objective of ACLs in a single sentence—ACLs allow specification of a set of group permissions based on the unique combination of a group, business object, and logical operation.

For example, an ACL declaration for JBCP calendar might declare that a given user has to write access to his or her own event. This can be shown as follows:

Username	Group	Object	Permissions
mick		event_01	read, write
	ROLE_USER	event_123	read
	ANONYMOUS	Any event	none

You can see that this ACL is eminently readable by a human—mick has read and write access to his own event (event_01); other...