Access Control Models: DAC, MAC, RBAC and ABAC Compared

Updated 1 Nov 2026 · 7 min read

On this page

The models at a glance
Discretionary access control (DAC)
Mandatory access control, labels and clearances
Role-based and rule-based access control
Attribute-based access control (NIST SP 800-162)
Least privilege, need to know and separation of duties
How this fits your exam
Frequently asked questions
Sources

After this page you will be able to tell the five access control models apart by asking one question: who or what makes the access decision, and on what basis? You will also be able to separate least privilege, need to know and separation of duties, three principles that sit on top of whichever model an organisation uses. Most definitions come from NIST publications, so you can check them yourself.

The models at a glance

Model	Who decides	Decision based on	Example from NIST
Discretionary (DAC)	The object's owner	Identity and permissions the owner sets	A file owner chooses which users may read or write the file
Mandatory (MAC)	A central authority, enforced by the system	Security labels and clearances	A Secret process may not read a Top Secret file
Role-based (RBAC)	Whoever assigns roles and the permissions each role carries	The subject's role	A doctor role can prescribe medication and order laboratory tests
Rule-based	Rules the organisation defines in advance	Predetermined, configured rules	A router allows or denies traffic by network address and protocol
Attribute-based (ABAC)	A policy evaluated at request time	Attributes of subject and object, plus environment conditions	Nurse Practitioners in Cardiology can view heart patients' records

Discretionary access control (DAC)

NIST IR 7316 says DAC leaves a certain amount of access control to the discretion of the object's owner or anyone else who is authorised to control the object's access. The owner of a file decides which other users get which combination of read, write and execute. Access control lists and owner, group and other permissions are, in NIST's words, by far the most common mechanisms for implementing DAC.

DAC is flexible, but IR 7316 names two weaknesses. First, read access is transitive: if Ann lets Bob read her file, nothing stops Bob copying it into a file he owns and sharing that copy. Second, DAC is vulnerable to Trojan horse attacks, because a program runs with the identity of the user who launches it.

Mandatory access control, labels and clearances

Under MAC, access decisions are made by a central authority, not by the owner, and the owner cannot change access rights. NIST's example is military security, where a data owner does not decide who holds a Top Secret clearance and cannot reclassify a Top Secret object as Secret. SP 800-53 Rev. 5 describes MAC as a type of nondiscretionary access control.

MAC relies on two pieces of information. A security label is a piece of information that represents the security level of an object. A clearance is a formal determination that a person is authorised to access a specific level of classified information, on a need-to-know basis. The system compares the two.

IR 7316 gives the two classic rules. A process running at Secret should not be allowed to read a file labelled Top Secret, which is the simple security rule, or "no read up". A process running at Secret should not be allowed to write to a file labelled Confidential, which is the *-property (star property), or "no write down". A stricter variant, the strict *-property, allows writing at but not above the subject's clearance level. IR 7316 names the Bell-LaPadula confidentiality model and the Biba integrity model as multilevel models used to formally specify this kind of policy, and SP 800-53 Rev. 5 gives Bell-LaPadula as a MAC policy that protects confidentiality and Biba as one that protects integrity. The NIST sources cited here do not list Biba's own rules, so this page does not state them. Take those from your official study material.

Role-based and rule-based access control

SP 800-53 Rev. 5 defines role-based access control as access based on user roles, where a role is a collection of access authorisations a user receives by assuming it. Permissions can be inherited through a role hierarchy, and one role can apply to one person or many. IR 7316's hospital example gives the doctor role operations to diagnose, prescribe medication and order laboratory tests, while a researcher role can be limited to gathering anonymous clinical information. IR 7316 also notes that RBAC is technically a form of non-discretionary access control, even though many texts list it as a third primary policy beside DAC and MAC.

RBAC struggles when decisions depend on more than the job title. SP 800-162 warns that expressing conditions such as location or recent training as roles leads to many ad hoc roles with few members, which it calls "role explosion".

Rule-based access control is looser as a term. IR 7316 states there is no commonly understood definition or formally defined standard for it, unlike DAC, MAC and RBAC. It covers systems that grant access based on predetermined, configured rules, such as a router that decides by network address, domain and protocol, or a business rule that denies service to customers with overdue balances. Rules can be combined with roles, with the role treated as one input to the rule.

Attribute-based access control (NIST SP 800-162)

NIST SP 800-162 defines ABAC as an access control method where requests are granted or denied based on assigned attributes of the subject, assigned attributes of the object, environment conditions, and a set of policies specified in terms of those attributes and conditions. Environment conditions are independent of subject and object and may include the current time, day of the week, a user's location or the current threat level.

SP 800-162's worked example is easy to remember. Nancy Smith is assigned the attributes Nurse Practitioner and Cardiology Department. A folder is labelled Medical Records of Heart Patients. The rule says all Nurse Practitioners in the Cardiology Department can View the Medical Records of Heart Patients. When a new nurse practitioner joins that department with the same attributes, no rule or object has to change.

SP 800-162 says ACLs and RBAC are in some ways special cases of ABAC in terms of the attributes used: ACLs work on the attribute of identity and RBAC works on the attribute of role. It also says ABAC systems can enforce both DAC and MAC concepts. In a typical implementation, a policy decision point (PDP) renders the decision and a policy enforcement point (PEP) enforces it.

Least privilege, need to know and separation of duties

Least privilege. Control AC-6 in SP 800-53 Rev. 5 requires only authorised accesses that are necessary to accomplish assigned organisational tasks, and the principle applies to processes as well as users.

Need to know. NIST's glossary, citing CNSSI 4009, describes a need-to-know determination as a decision by an authorised holder of official information that a prospective recipient requires access to specific official information to carry out official duties. ISACA's glossary frames the difference neatly: need to know controls what individuals can see, and least privilege extends it by granting the least system access necessary to do the job.

Separation of duties. Control AC-5 asks organisations to identify duties that need separating and to define system access authorisations that support the separation. Its discussion explains that this helps reduce the risk of malevolent activity without collusion, and gives the example of making sure security staff who administer access control do not also administer audit functions. IR 7316 adds a static example: if one role requests expenditures and another approves them, the same user can be barred from holding both.

How this fits your exam

ISC2 CISSP. The outline, effective 15 April 2024, lists under objective 5.4 role-based, rule based, mandatory, discretionary, attribute-based and risk based access control, plus access policy enforcement such as the policy decision point and policy enforcement point. Objective 3.2 names Biba, Star Model and Bell-LaPadula as security models, and objective 7.4 lists need-to-know and least privilege alongside separation of duties. The CISSP guide covers the other domains.

CompTIA Security+ SY0-701. Objective 4.6 lists mandatory, discretionary, role-based, rule-based and attribute-based access controls, together with time-of-day restrictions and least privilege. The Security+ SY0-701 guide explains the full blueprint.

ISC2 SSCP. The outline, effective 1 October 2025, lists in objective 2.4 mandatory, discretionary, role-based (with subject-based, object-based and privileged access management as examples), rule-based and attribute-based access control. Objective 1.2 lists least privilege and segregation of duties. See the SSCP study guide.

Frequently asked questions

Is RBAC discretionary or mandatory?

Neither label fits perfectly. NIST IR 7316 describes RBAC as technically a form of non-discretionary access control, while noting that many security texts list it as a third primary model next to DAC and MAC. IR 7316 explains that non-discretionary policies establish controls that cannot be changed by users, but only through administrative action.

Does RBAC mean role-based or rule-based?

Both, which is why it causes confusion. The SY0-701 acronym list expands RBAC as both role-based access control and rule-based access control. NIST IR 7316 avoids the clash by writing RuBAC for rule-based. Read the question for words such as "job function" or "rule" to work out which is meant.

How is least privilege different from separation of duties?

Least privilege limits how much access one person or process has. Separation of duties splits a sensitive task across people so that no single person can complete it alone. You can grant someone minimal access and still break separation of duties if that access lets them both request and approve the same payment.

Sources

Work through the SSCP exam guide, then check yourself on access control with free SSCP practice questions.