How do Windows NT ACLs work?

Question

How do Windows NT (especially XP, Vista and Server 2008) ACLs (access control lists) work? What is the basic philosophy underlying them, that is, exactly what is stored, conceptually, in the ACLs, and how are access permissions evaluated based on the stored information?

What are the basic, command line and otherwise, utilities for managing them?

Perhaps also include links to related documentation or tutorials in the answer!

PS. Perhaps I should be asking this in Serverfault?

Answer 1

Microsoft has been so good as to provide ample online documentation on the subject:

MSDN: Access Control Lists