There are several areas where the ACL can be managed. Overall "Global" settings can be configured in the Global Configuration under Permissions, while much more granular settings are available elsewhere in the Joomla Administrator. Access can even be set on an Article by Article basis if necessary.

The ACL in Joomla has been one of the least understood, and perhaps most powerful features of Joomla's CMS. In version 1.6, an overhaul of the ACL system took place, and access control got a bit easier to understand but didn't lose any of its usefulness.

Joomla's ACL is fully demonstrated in the Joomla Users section of Joomla Pro.

Further reading:
Joomla ACL Actions Explained
More Joomla ACL Articles