access enforcement mechanism

A control implementation — realized as hardware, software (e.g., access control lists, access control matrices), firmware, cryptography, or combinations thereof — that carries out an organization's access control policy by permitting or denying subjects (users or processes) the ability to interact with objects (files, records, devices, domains, programs). It is distinguished from the policy itself by being the operative, runtime layer that actually applies decisions; the policy declares what is authorized, while the mechanism enforces it. In practice, the field uses the term to denote the full range of such implementations deployed at multiple tiers — system, network boundary, application, and service levels — with the understanding that mechanisms at deeper tiers (e.g., application-level) supplement rather than replace system-level enforcement.