This read-create INTEGER, set per interface, holds the index of the ACL applied to that interface's ingress traffic, with 0 meaning no ACL is applied. An admin uses this to directly attach an access control list to filter incoming traffic on a specific port, independent of any policy-map-based classification also configured there. For example, an admin wanting to block traffic from a specific untrusted subnet arriving on a particular port would set this field to the index of an ACL that denies that subnet.