Is Access control list a hardware or software?

Sorry if the question sounds stupid