Glossary
Access Control List (ACL)
An access control list is attached to the resource it protects and names which identities may reach it, and under what operations. Checking access means looking up the requester in that list at the time of the request, which makes revocation straightforward: remove the entry, and the access is gone everywhere at once, because there is exactly one list to consult.
The tradeoff runs the other way from a capability's: an access control list requires the checking system to reliably know and verify the requester's identity for every request, and granting narrow, purpose-specific access to a resource means adding and later removing individual list entries rather than handing over a single self-contained token.