1. An access control system comprising: a knowledge database configured to store (i) information indicative of a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device, (ii) information indicative of a relationship between a position as an access source of access to the resource, and access source identification information capable of identifying the position, or (iii) information indicative of a relationship between the resource and access destination identification information capable of identifying the resource; and a policy engine configured to (i) store an access control policy describing at least the group, position, and resource of the information stored in the knowledge database, (ii) generate an access control list indicating accessibility/inaccessibility to an access destination from an access source by use of the access control policy and the information stored in the knowledge database, and (iii) set the access control list in an existing access control device.