Each file has an Access Control List (ACL) that stores who is allowed which level of access. Permissions are denied by default and with conflicting groups.

Files and folders have similar permissions.