MAC and DAC: Who Actually Decides Who Gets In

Every access control model is answering one question: who gets to decide what you can touch. The first split is between the system deciding and the owner deciding.

Mandatory Access Control puts the operating system in charge, and the user can't override it. It's rule-based in a precise sense: every user and every resource carries a label, and the OS compares them on each access. The canonical example is government clearances: a user cleared to Secret can open Secret and Confidential documents but not Top Secret, and nobody below can grant them that. The system enforces the lattice, full stop. On Linux the primary implementation is SELinux, originally built by the NSA and shipped in RHEL, Fedora, and the RHEL rebuilds like Rocky and AlmaLinux (CentOS lives on as CentOS Stream now that CentOS Linux is end-of-life). MAC is rigid on purpose: it's what you want when a mistake, or a compromised account, must not be able to widen its own access.

flowchart TD OS["OS enforces · user cannot change"] U["User: Secret clearance"] --> OS OS -->|allow| D1["Confidential doc"] OS -->|allow| D2["Secret doc"] OS -->|deny| D3["Top Secret doc"]
MAC and DAC: Who Actually Decides Who Gets In

Discretionary Access Control flips it: the resource owner sets the permissions and can delegate them. It's the most common model because it's flexible: the person who made the file decides who else gets in, which is how most organizations actually operate. On Windows this is NTFS, and its permission set is worth knowing by name: Full Control, Modify, Read & Execute, Read, and Write, each layering on more capability. In practice it's an ACL hanging off the object: Alice owns a folder and grants Bob Full Control, Carol read/write, and Tracy read-only, with no administrator in the loop.

flowchart LR A["Owner: Alice"] -->|sets| ACL["Folder ACL"] ACL --> B["Bob: Full Control"] ACL --> C["Carol: Read / Write"] ACL --> T["Tracy: Read-only"]
MAC and DAC: Who Actually Decides Who Gets In

The trade-off is the whole story. DAC's flexibility is also its weakness: owners over-share, misjudge, and forget to revoke, and there's no system-level backstop when they do. MAC's rigor is also its cost: it's heavier to administer and unforgiving, which is why you see it in high-assurance environments and in targeted enforcement (SELinux confining a specific service) rather than as the everyday default. Most shops run DAC and reach for MAC where the stakes justify taking the pen out of users' hands.