A mechanism that defines the type of access that is granted to an object (an object can be identified with a security identifier) or object attribute.