How do you define: Attribute-Based Access Control?

I tried to understand the Revo’s permission, and the reason behind this.
The best shot I got is http://en.wikipedia.org/wiki/Attribute_based_access_control#Attribute-based_Access_Control

Would anyone point me to a link to make me understand about this?
If I can’t understand this, I will never make sure my client that ’the permission is easy...’ ?

Basically, this means that a User is restricted not by their ’rights’, but by what Permissions the User has. It allows more fine-grained control of various actions from within an application.

They are done via ACLs, or Access Control Lists, which are basically just Permissions. A Permission can be anything, such as ’content_types’, which allows access to the Content Types page. If the User doesn’t have that Permission (gained through their User Group in Revo), they wont have access to the Content Types page.

P.S. I’ve been working on and expanding the Security docs today:

http://svn.modxcms.com/docs/display/revolution/Security+Introduction