"In addition, access to each object is controlled through an access control list which specifies the processes authorized to access the object, and the types of access that are allowed." . . . .