s accessobjects gt is_a lt s ontologyobjects gt lt s inontology gt lt v gt lt s accessrights gt lt s allowwrite gt lt s allowread gt lt s accessagents gt lt s m gt lt s grantrights gt lt s allowgrant gt lt s grantto gt lt s c gt is_a lt s systemgrantaccesslist gt note that the anonymous access list used here is no longer a member of u201c systemaccesslist u201d class but only a member of u201c accesslist u201d because it is not active in the system it only means that the user c can create u201c active u201d access lists that matches this access list the u201c allowgrant u201d individual as a value of u201c grantrights u201d property means that the user u201c c u201d can himself delegate other users only from group m to be able to grant rights in the specified domain to further explain the granting mechanism we can suppose that there are three classes in the u201c w u201d ontology u201c p u201d u201c r u201d and u201c q u201d now let 39 s suppose that the user u201c c u201d which is the u201c manager u201d inside the u201c n u201d group for the u201c w u201d ontology decides that the user u201c b u201d another user from u201c n u201d group should be granted write access only to.