A data field in an access control list (ACL) that specifies an operation that can be done with that keychain item, such as decrypting or authenticating.