The ACL lists the user and group access rights to the files in the associated directory. Each ACL applies to all of the files in its associated directory. Using ACLs allows AFS to define seven rights rather than just the standard three. Another refinement to the standard UNIX protection scheme is that users can define their own protection groups and then place the groups on ACLs as though they were individual users. This makes it easy to assign the same rights to many people simultaneously.
Machines can also be members of a group.
When logged into a machine that is a member of a group, a user is given all of the access rights of that group. The Protection Server maintains a Protection Database that stores entries for groups, individual users, and machines, and charts the membership relationships between them. Section 6.1 in the Reference Manual details the structure of database entries. The pts command interface allows system administrators and regular system users to create, modify, and delete entries in the Protection Database by interacting with the Protection Server. Regular users may manipulate the group entries they own or for which they have the necessary privilege.