Authorization Determination Must indicate who is allowed to do what with what. Draw the general form as an access matrix with one row per user, one column per file. Each entry indicates the privileges of that user on that object. In the most general form, each file has a list of pairs. It would be tedious to have a separate listing for every user, so they are usually grouped into classes.
Access lists are simple, and are used in almost all file systems.
Store a list of pairs with each user. This is called a capability list . Typically, capability systems use a different naming arrangement, where the capabilities are the only names of objects. You can't even name objects not referred to in your capability list. In access-list systems, the default is usually for everyone to be able to access a file.