An entry in either a securable object's discretionary access control list (DACL) or an object's system access control list (SACL). In a DACL, the entry grants or denies permissions to a user or group. In a SACL, the entry specifies which security events to audit for a particular user or group or controls the Windows Integrity Level for the object.