Figure 1.
Inside the Security Descriptor.
You can associate a Security Descriptor (SD) with many different object types. The SD contains information about who can manipulate the object and how.