I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
    A["Discretionary\nprivilege grants"] -- "Mandatory / role-based models" --> B["Security policy &\nseparation of duties"]
    style A fill:#f9f9f9,stroke:#333,stroke-width:3px
    style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A policy framework that restricts access rights to resources within a system according to a subject’s identity, security clearance, or role, in order to block unauthorized access.

Features:
( Least Privilege ) Grants only the minimum privileges truly required for a duty or role, preventing insider threats and containing the spread of incidents
( Separation of Duties ) Separates the execution of key tasks from the authority to approve them, cutting off fraud and misuse at the source
( Centralized Control ) Verifies and approves access to every resource from a single point under a consistent security policy

II. Mechanism & Components

A. Architecture Comparison Across Access Control Models

flowchart LR
    subgraph DAC ["DAC (Discretionary)"]
        Owner["Owner"] -->|"Grants privilege"| User1["User"]
    end

    subgraph MAC ["MAC (Mandatory)"]
        Policy["Security Policy (Label)"] -->|"Enforces"| Object["Resource / Subject"]
    end

    subgraph RBAC ["RBAC (Role-Based)"]
        Admin["Administrator"] --> Role["Role"]
        Role --> User2["User"]
    end

Explanation: In DAC, the owner grants privileges; MAC is enforced by the system through security labels; RBAC manages access through an intermediate “role” layer.

B. Technical Characteristics Comparison

ItemDiscretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC)
Full NameDiscretionary Access ControlMandatory Access ControlRole-Based Access Control
Basis for DecisionSubject’s identitySecurity label / clearanceUser’s role
Privilege GrantingDecided at the discretion of the resource ownerEnforced uniformly by the system / administratorCentral administrator assigns roles
SecurityLow (privileges can be misused)Very high (cannot be bypassed)Moderate to high (supports separation of duties)
FlexibilityVery high (user-centric)Low (management overhead on change)High (adapts easily to organizational change)
Typical UseWindows / Linux file permissionsDefense, government agencies (multilevel security)General enterprise (ERP), financial industry

III. Advanced Topics & Comparison

ModelKey Security ThreatMitigation
DACTrojan horses, privilege propagationSecurity auditing (logging) and stronger ACLs
MACReduced availability, management complexityPerformance optimization of the security kernel
RBACRole explosionRole hierarchies and constraints

Last updated 18 Aug 2026, 00:00 UTC. history