Access-control lists are rule sets that specify which users, devices, or network addresses may access a resource and what actions they may perform. They enforce least-privilege access to industrial assets and services.