Types of access list entries

There are two types of access lists entries for addressability to address spaces. The two types differ from each other in the amount of authority-checking that the system does when a program in AR mode issues a data-referencing instruction and the data is in another address space.

An access list entry for an address space is either a public entry or a private entry, and a combination of both these types can be on the same DU-AL or PASN-AL.

A program can access the target address space through a public entry if it has (1) the access list entry that identifies the address space, and (2) the ALET for the entry.
A program can access the target address space through a private entry if it has (1) an access list entry that identifies the address space, (2) the ALET for the entry, and (3) the appropriate extended authorization index (EAX) value.

To be authorized to access the target address space, a program might need a certain EAX value. When it has that value, it is EAX-authorized to the address space. Establishing this authorization is a complex programming effort. It is described fully in EAX-authority to an address space.

It is enough at this point to know that:

Public entries allow any program that has the ALET to use the target address space.
Private entries can prevent a program from accessing data in an address space.
Data spaces are accessed only through public entries.