Figure 1. Inside the Security Descriptor.
You can associate a Security Descriptor (SD) with many different object types. The SD contains information about who can manipulate the object and how.