This is way more flexible than ACL:
 - does not need admin rights to edit,
 - does not assume the clients have fixed IP addresses,
 - does not assume the clients are single user systems,
 - is a better understood concept than access control lists.