Access Control Matrix

An access control matrix does not exactly represent the granularity of security procedures. For this reason, it can be used as a model of static access rights in any type of access control system. It also doesn’t model the rules in which permission may be modified in any particular system, thus it only provides an incomplete description of the system’s security policy. An access control matrix is often defined as an abstract security model that only gives permissions at a specific time. This is because it’s implementation as a two-dimensional model would likely have strict memory requirements. Access control lists and capability-based security are two categories of concrete access control mechanisms. Both of their static permissions can be modeled using an access control matrix. Though both mechanisms have been presented as column-based and simple row-based implementations of the access control matrix, this view has been criticized due to misleading beliefs of equivalence amongst the two systems.