Which access list must be applied?