🔑Discretionary Access Control

NEW

Also known as: DAC

An access control model in which resource owners specify permissions on objects and can grant or revoke access at their discretion.

DESCRIPTION

Discretionary Access Control governs permissions based on the resource owner’s decisions, commonly implemented via Access Control Lists or permissions on files and database objects. DAC is flexible and widely used in operating systems and applications, but it can be prone to inadvertent overexposure if owners misconfigure permissions. Organizations often combine DAC with policy frameworks, least privilege, and governance controls. Alternatives like MAC, RBAC, and ABAC address different needs for centralized policy, role abstraction, or attribute-based rules.

ALTERNATIVE DEFINITIONS

NIST Glossary

A means of restricting access to objects based on the identity of subjects and/or groups to which they belong.

Concise NIST glossary framing DAC around subject identity and groups.

Source

IETF RFC 4949

A means of restricting access to objects based on the identity of subjects and/or the groups to which they belong; the owner of an object has discretion to grant access.

Highlights the owner’s ability to transfer or grant authorization.

Source

RELATED TERMS

Access Control List Identity Management Least Privilege Policy-Based Access Control Capability-Based Security Privilege Management Authorization

COMPETING TERMS

Mandatory Access Control RBAC Attribute-Based Access Control

RELATIONS

• Broader: Access Control

KNOWLEDGE AREAS

Data Security Data Governance

TARGET AUDIENCE

Security Architect Chief Information Security Officer Data Governance Manager IT Manager Application Administrator

EXTERNAL SOURCES

• Wikipedia - Discretionary access control
• NIST - Official glossary definition of DAC
• IETF - Internet Security Glossary defining DAC
• OWASP - Best practices for authorization models
• NIST - Access control families and controls

TOP QUESTIONS

When should Discretionary Access Control be preferred over RBAC?

Use DAC for granular, owner-managed resources in smaller teams or applications where flexible ad-hoc sharing is needed. RBAC suits centralized, role-driven enterprises.

Category: Opinion

What are common mistakes with Discretionary Access Control?

Owners granting broad permissions, stale ACLs, and lacking periodic reviews can create overexposure and security risks.

Category: Mistakes

How does Discretionary Access Control relate to least privilege?

DAC should be used with least-privilege guidelines so owners grant only minimal necessary access and revoke unused permissions.

Category: Requirements

Is Discretionary Access Control suitable for regulated environments?

It can be, but organizations often complement DAC with MAC or ABAC for stricter policy enforcement and auditability.

Category: Risks

What is the biggest misunderstanding about Discretionary Access Control?

That DAC is inherently insecure; in reality, disciplined governance and reviews make DAC effective for many workloads.

Category: Misunderstanding

How is Discretionary Access Control managed at scale?

Automate ACL provisioning, enforce naming and ownership conventions, and run periodic permission recertifications.

Category: Management

What are alternatives competing with Discretionary Access Control?

Mandatory Access Control, Role-Based Access Control, and Attribute-Based Access Control offer different policy models.

Category: Alternatives

Why is Discretionary Access Control still relevant today?

DAC’s flexibility fits collaborative apps, data platforms, and file systems where owners must share resources dynamically.

Category: Relevancy

How do Access Control Lists implement Discretionary Access Control?

ACLs list principals and permissions for each object, enabling owners to edit entries to grant or revoke access.

Category: Example