Abstract: A layer of abstraction for use by access control lists is provided for the process of creation and maintenance of user permissions on computer resources. First, a set of permissions can be associated with any number of computer resources. Also, computer resources can store references to any number of sets of permissions, and when use is requested, the sets of permissions are combined into a merged set that determines whether permission is granted. The extra level of abstraction results in an extra layer of information that allows individuals administering permissions to computer resources the ability to understand why they are set. The extra layer of information also results in a history of permissions for the computer resource since multiple references to sets of permissions can be stored.