Access Control List (ACL) Permissions
In addition to (or instead of) locks, each stream can have one or more permissions on it. Whereas a lock controls the ability to create new versions (through the Promote command), a permission is more general: in addition to controlling Promote, it controls the ability to read data from the stream, using such commands as Annotate, Diff, and Open. A permission also controls workspace-specific commands, such as Update and Populate.
Unlike locks, which always apply to individual streams, ACL permissions can be configured to apply to entire stream subhierarchies.
You can create an ACL permission that applies to an entire depot. This provides a way of controlling access to all of a depot's file system data, in all streams. It also provides a way to control access to a depot's AccuWork issues.
For more on ACL permissions, setacl in Command Line Interface.