1. A method comprising: defining, by one or more computing devices, a global system access control list (SACL) for a resource that includes a plurality of objects, the global SACL configured to indicate one or more activities associated with the resource that are to be audited; and distributing, by the one or more computing devices, a group policy that contains the global SACL as part of a list of SACLs, such that one or more processors associated with the resource, in response to an attempt to access to a particular said object associated with the resource, identifies the global SACL within the list of SACLs based, at least in part, on a type associated with the resource, and merges the global SACL with an object SACL for the particular said object associated with the resource to audit the attempt to access the particular said object associated with the resource, the global SACL is not promulgated among SACLs corresponding to said objects associated with resource before the attempted access to each of said objects associated with the resource.