Read Pages 148-149 in the “webMethods Integration Server Administrator’s Guide Version 6.1”
This applies to v4.x too.
In case, you don’t have access to the guide; here it is for your reference.
[i]
Assigning ACLs to Files the Server Can Serve
The server can serve files that reside in the pub directory for a package or a subdirectory
of the pub directory.
You control access to files by placing a .access file in the directory that contains files you
want to protect. You can use an operating system tool of your choice to edit the .access file.
If the directory contains subdirectories, they will not inherit the protection, so you must
provide a .access file in each directory. For each file in the directory that you want to
protect, place a line in the .access file to identify the file and the ACL you want to use to
protect the file.
For example, assume you have a directory that contains three files (adminpage.dsp,
home.dsp, and index.htm). You want to protect the adminpage.dsp file with the
Administrators ACL so that only administrators can access this file. You want to protect
the home.dsp file with the Developers ACL so only developers can access this file. You
also want to assign the Default ACL to the index.htm file so all users can access it. To
accomplish this, you would place the following records in the .access file:
adminpage.dsp Administrators
home.dsp Developers
index.htm Default
Rules for Using .access Files
When making entries in .access files, observe the following rules:
a) Specify the file name only, such as adminpage.dsp followed by the ACL name. If you
specify a relative path, the file will not be protected. For example, suppose file
home.dsp is in subdirectory docs in directory pub (pub\docs\home.dsp). If you add
the following entry to the .access file on directory pub, the file will not be protected:
docs\home.dsp Developers
Instead, add the following entry to the .access file on directory pub\docs:
home.dsp Developers
b) The case in which you enter the name depends on how your file system handles case.
Suppose you have a file named index.dsp. If you use a case-insensitive system such as
Windows, you can enter the file name in any case. Therefore Index.dsp, INDEX.DSP,
and so on are all acceptable. However, if you use a case-sensitive system such as Unix,
you must enter index.dsp.
Important! The Integration Server loads .access files when a package is loaded; therefore, if
you want the changes you make to take effect immediately, reload the package.
[/i]
You can find the same information in the IS Admin Guides v4.x