You can consider Security Descriptors as an extended attribute to the file or folder. To begin, each object in the file hierarchy has a Security Descriptor associated with it. This was revamped in Windows 2000 onwards and is the basis of almost all the file permission security functionality present in modern day Windows OS. When the NTFS file system was originally introduced in Windows NT, the security permissions framework had major shortcomings. So, how exactly is access to these sets of hierarchical objects controlled exactly? That is what we will talk about next. Folders are therefore referred to as Containers, ie objects that can contain other objects. there can be no further branches off that leaf node. Each folder can have any number of files and these files can be considered as leaf nodes. So let’s begin at the very beginning, the NTFS file system can be considered as a hierarchical tree structure, with the disk volume at the top level and with each folder being a branch off the tree. These permissions not only control access to all files and folders in the NTFS file system, it also ensures the integrity of the operating system and prevents inadvertent and unauthorized changes by the non-admin users as well as by malicious programs and applications. One of the most important and often misunderstood pieces of functionality in Microsoft Windows is the File and Folder security permissions framework.

New Technology File System (NTFS) Hierarchical Tree Structure of NTFS

Windows folder permissions report