Editing Computer security (section)

===Capabilities and access control lists===
{{Main|Access control list|Role-based access control|Capability-based security}}

Within computer systems, two of the main [[Computer security model|security models]] capable of enforcing privilege separation are [[access control list]]s (ACLs) and [[role-based access control]] (RBAC).

An [[access-control list]] (ACL), with respect to a computer file system, is a list of permissions associated with an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

Role-based access control is an approach to restricting system access to authorized users,<ref>{{cite journal |author1=Ferraiolo, D.F. |author2=Kuhn, D.R. |name-list-style=amp |date=October 1992 |title=Role-Based Access Control |url=http://csrc.nist.gov/groups/SNS/rbac/documents/ferraiolo-kuhn-92.pdf |journal=15th National Computer Security Conference |pages=554–563}}</ref><ref>{{cite journal |last1=Sandhu |first1=R |last2=Coyne |first2=EJ |last3=Feinstein|first3=HL |last4=Youman |first4=CE |date=August 1996 |title=Role-Based Access Control Models |url=http://csrc.nist.gov/rbac/sandhu96.pdf |journal=IEEE Computer |volume=29 |issue=2 |pages=38–47 |citeseerx=10.1.1.50.7649 |doi=10.1109/2.485845 |s2cid=1958270}}</ref><ref>{{Cite conference |author1=Abreu, Vilmar |author2=Santin, Altair O. |author3=Viegas, Eduardo K. |author4=Stihler, Maicon |date=2017 |title=A multi-domain role activation model |url=https://secplab.ppgia.pucpr.br/files/papers/2017-1.pdf |conference=2017 IEEE International Conference on Communications (ICC) |publisher=IEEE Press |pages=1–6 |doi=10.1109/ICC.2017.7997247 |isbn=978-1-4673-8999-0 |s2cid=6185138}}</ref>  used by the majority of enterprises with more than 500 employees,<ref name="autogenerated2002">{{cite book |author1=A.C. O'Connor |url=http://csrc.nist.gov/groups/SNS/rbac/documents/20101219_RBAC2_Final_Report.pdf |title=Economic Analysis of Role-Based Access Control |author2=R.J. Loomis |date=2002 |publisher=Research Triangle Institute |page=145 |name-list-style=amp}}</ref> and can implement [[mandatory access control]] (MAC) or [[discretionary access control]] (DAC).

A further approach, [[capability-based security]] has been mostly restricted to research operating systems. Capabilities can, however, also be implemented at the language level, leading to a style of programming that is essentially a refinement of standard object-oriented design. An open-source project in the area is the [[E programming language|E language]].