Action: The navigation item
Permission: The access rule (allow or deny)
Affects: The user or group that is affected by this rule
Global ACL rules are applied first. They affect all users (including anonymous).
You can have one group's or user's ACL ruleset apply to another through inheritance. This allows multilevel permission to be set more efficiently.
These rules are run last and can override the global ruling. If a page is denied for all users, and I make a rule so
myuser is granted access to that page,
myuser will be able to view it without a problem, while the rest remain blocked.