System ACLs are controlled by the security administrators. The permissions that can be granted or denied for an object depends on the type of object. For example, you can specify permissions, such as Manage Documents and Print for a printer queue, and specify Read, Write, Execute for a directory. Permissions of an object are also affected by whether that object is a container object or a noncontainer object. For example, a directory is a container object that logically contains files and other directories.
Files are noncontainer objects.
This distinction between container and noncontainer objects is important because objects within a container object can inherit certain permissions from the parent container. NTFS supports ACL inheritance from directory objects to file objects that are created within the directory. The discretionary ACEs are AccessAllowed and AccessDenied. These explicitly grant and deny access to a user or group of users. The first AccessDenied ACE denies the user access to the resource, and no further processing of ACEs occurs.