1. A machine-implemented method, comprising: receiving a request that requires a privilege for a resource; wherein said resource is protected by at least two ACLs; wherein said at least two ACLs are associated with at least two ACL types; determining that said privilege is not a member of an intersection set containing privileges that are common to all ACL types of said at least two ACL types; and denying said privilege for said request; wherein the steps of determining and denying are performed by one or more computing devices.