Some systems combine a mechanism like this with access control lists. Forexample, on VMS 4.0 and later, a file may be given an access control listthat grants or denies certain access rights to certain specified users. If afile has an ACL (and most won't), the ACL is checked first:
If the ACL grants the access, the access is granted without furtherchecking.
If the ACL denies the access, the access is denied without furtherchecking unless the user has certain privileges.
The regular protection code is checked only if the ACL does notmention the user, or if the user was denied access but has certainprivileges.