Security Reference Monitor (SRM) The primary authority for enforcing the security rules of the security integral subsystem.[20] It determines whether an object or resource can be accessed, via the use of access control lists (ACLs), which are themselves made up of access control entries (ACEs). ACEs contain a Security Identifier (SID) and a list of operations that the ACE gives a select group of trustees—a user account, group account, or login session[21]—permission (allow, deny, or audit) to that resource.[22][23]