Access Control List (ACL) Permissions
In addition to (or instead of) locks, each stream can have one or more permissions on it. Whereas a lock controls the ability to create new versions (through the Promote command), a permission is more general: in addition to controlling Promote, it controls the ability to read data from the stream, using such commands as Annotate, Diff, and Open. A permission also controls workspace-specific commands, such as Update and Populate.
Unlike locks, which always apply to individual streams, ACL permissions can be configured to apply to entire stream sub-hierarchies.
You can create an ACL permission that applies to an entire depot. This provides a way of controlling access to all of a depot's file system data, in all streams. It also provides a way to control access to a depot's AccuWork issues.
For more on ACL permissions, setacl in Command Line Interface.