Permissions are no more than single logical identifiers represented by bits in an integer. An access control entry grants permissions to SIDs based on the bitmask, which comprises the logical AND of all permissions applicable to that access control entry.
The default permission implementation, o.s.s.acls.domain.BasePermission, defines a series of integer values representing common ACL authorization verbs. These integer values correspond to single bits set in an integer, so a value of BasePermission, WRITE, with integer value 1 has a bitwise value of 21 or 2.
These are illustrated in the following diagram:
We can see that ...
