&T is a shared reference and &mut T an exclusive one. At any time you may have many &T or exactly one &mut T, never both. The borrow checker enforces this at compile time, which prevents data races and iterator invalidation.