Functionality Principals with the appropriate rights must be able to read and set access control information. August 1998 Principals MUST be uniquely identifiable. It must also be possible to specify special types of principals, in particular all authorized principals, all anonymous principals, and all principals. It must be possible to set ACLs individually on both collections and resources. The protocol draft must provide an algorithm by which conflicts between rights, both granted and denied, for a particular principal on a particular resource are unambiguously settled.
Discovery is itself subject to access control.
It should be acceptable to deny unprotected transactions. It is recommended that users be able to add access control information to an object without having to reset all access control settings. Similarly, it should be possible for users to be able to remove, delete or clear access rights without having to reset all rights. This may be impossible if another user has access to the resource without using DAV, in which case other access control mechanisms may apply. The underlying implementation may have advanced access control which is more restrictive than the DAV access control.