FACL

Per-file or per-directory permissions that control access at the filesystem level.

A FACL extends basic filesystem permissions by allowing fine grained, per user and per group access rules on individual files and directories beyond the traditional owner, group, and others scheme. This supports least privilege by granting specific entities precise rights without altering broad ownership. On Linux these are managed with utilities such as setfacl and getfacl. The exam relevance is recognizing FACLs as a host based discretionary access control mechanism, distinct from network ACLs that filter traffic by address, port, and protocol on devices.