ACLs don’t (2009) shiftleft.com

A 2009 HP Labs report argues that access-control lists (ACLs) can make incorrect decisions when an interaction involves more than two principals, because information is lost as messages are passed. It says this limitation underlies clickjacking and cross-site request forgery attacks against web applications.