describes the way in which a subject may access an object. read write execute delete  create search
restrict a user's access to only those files they need in order to perform their job. initially allocated to them by the network manager.
hmm