A security policy that determines whether a user or group can access a specific item and perform an operation.