Whenever you create a new entry in the CDS namespace, an ACL is created for it implicitly, and its initial list of entries and their permission sets are determined by the ACL templates associated with the CDS directory in which you create the entry.
Each CDS directory has the following two ACL templates associated with it:
· Initial Container
This template is used to generate the initial ACL for any directories created within the directory.
· Initial Object
This template is used to generate ACLs for entries created within the directory.
Like other CDS objects, each CDS directory also has its own ACL, generated from the parent directory's Initial Container template when the child directory is created. The Initial Container template also serves as a template for the child directories' own Initial Container templates.