Certain embodiments of the invention relate to an access control system for controlling access to file system objects stored in a digital file system store. The system provides a first compartment rule type for granting a first permission to an entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path and list the contents of the said directory object, and a second compartment rule type for granting a second permission to an entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path and not to list the contents of the said directory object.