Tag: rule-based policies are less specific to the operation of a system than access control lists.