A way to assure data at-rest is secure even in the event of loss or theft is to use:

Full device encryption encrypts all data stored on the device using a cryptographic key tied to the user's authentication credentials or a hardware security module. If the device is lost or stolen, the encrypted data cannot be read without the correct key, even if the storage media is removed and connected to another system. This is the definitive technical control for protecting data at rest against physical theft or loss.

File system permissions control access only within a running, authenticated operating system session and can be bypassed by booting from external media or removing the drive.

TPM integration enhances key storage and platform integrity verification but alone does not encrypt all data on the device; it must be combined with a full disk encryption solution to protect data at rest.

Access Control Lists restrict which authenticated users or processes can access specific resources within a live OS session but provide no protection if the physical storage media is accessed directly.