Access Control Models

Once a system has authenticated a user, it must decide what that user is allowed to do — this is access control. Different organizations and systems use different models to structure these decisions, and choosing the right model has a major impact on both security and manageability. The three foundational models every security practitioner should know are DAC, MAC, and RBAC.

Discretionary Access Control (DAC) puts permission decisions in the hands of the resource's owner. Whoever creates or owns a file, folder, or object can decide who else gets to read, write, or execute it, and can change those permissions at will. This is the model used by most everyday operating system file systems — for example, when you create a document on your computer and choose to share it with a specific colleague, you are exercising discretionary control. DAC is flexible and easy to use, but because permission decisions are decentralized among many individual owners, it is harder to enforce consistent organization-wide policy and easier for permissions to sprawl or be granted too generously.

Mandatory Access Control (MAC) removes that discretion from individual users. Instead, the system itself enforces access decisions based on fixed labels and clearances defined by a central authority, and ordinary users — including resource owners — cannot override them. A classic example is a government or military classification system: a document might be labeled 'Secret,' and a user can only access it if their assigned clearance level is 'Secret' or higher, regardless of who created the document or whether they personally want to share it. MAC is used where strict, centrally enforced confidentiality is critical, because it eliminates the risk of an individual user misconfiguring or loosening permissions.

Role-Based Access Control (RBAC) ties permissions to roles rather than to individual users or rigid classification labels. Administrators define roles (such as 'HR Manager,' 'Billing Clerk,' or 'System Administrator'), assign specific permissions to each role, and then assign users to one or more roles. A new employee gains the correct access simply by being assigned the appropriate role, and access changes automatically when their role changes, without an administrator having to hunt down and adjust dozens of individual permission entries. RBAC is extremely common in business applications and cloud platforms because it scales well and closely mirrors how organizations already think about jobs and responsibilities.

The choice of access control model reflects a tradeoff between flexibility and central control. DAC is simple and user-friendly but scales poorly for security-sensitive organizations, since any owner can accidentally or intentionally over-share a resource. MAC provides the strongest, most consistent enforcement of confidentiality because no individual user can weaken it, but it is rigid, administratively heavy, and impractical outside high-security environments like defense and government systems. RBAC strikes a practical middle ground for most businesses: it centralizes policy (permissions are defined per role, not per person) while still scaling efficiently as employees join, move between teams, or leave, since administrators manage a manageable number of roles rather than an ever-growing web of individual grants. Many real-world systems combine elements of these models — for instance, using RBAC as the primary structure while layering MAC-like mandatory rules for especially sensitive data.