Access Control Lists (ACLs) are the standard mechanism servers use to enforce object-level permissions. An ACL specifies which users or groups can perform what actions (read, write, execute, delete) on specific objects like files, directories, or database records. Users, groups, and roles are entities that receive permissions, but ACL is the mechanism that enforces them at the object level.