it is implemented as the access control system in operating systems.

it is implemented as the access control system to provide Role-based Access Control (RBAC).

it is an abstract model (it is not implemented as it is)

it is implemented as the access control system in firewalls.