So far we have seen the basic and extended permission levels. In order for the permissions to be assigned to an accessor (user or group), they need to be placed inside a permission set. A permission set (also known as ACL or Access Control List) is simply a set of basic and extended permissions associated with different accessors.
A permission set is stored as an object of type dm_acl. Permission sets are used for controlling access only to the objects of type dm_sysobject (or any of its subtypes). The valid operations on renditions are controlled by the permission set on the primary object. Recall that renditions cannot be edited or checked out.
There are four categories of accessors that can be granted permissions in a permission set — owner (dm_owner is the alias for owner), specific users, specific groups, and world (dm_world is the alias for world). These categories are intended to be able to resolve the permissions of any user who may attempt to access an object...