To modify a security profile, you need control access to the object. An ACL grants control access explicitly, whereas a protection code grants it implicitly to anyone who belongs to the owner or system category. (See the to “Using Control Access to Modify an Object Profile” for a full description of how you can acquire control access.)