Most programmers are familiar with the access-control list (ACL) as a datastructure used for authorization. This article describes using a more robust structure called an access-control graph (ACG).