Which access control model is described by access decisions being controlled by the data owner?

Which access control model is described by access decisions being controlled by the data owner?

• A. MAC describes access based on security labels.
• B. DAC describes access controlled by the data owner.
• C. RBAC describes access by role.
• D. ABAC describes access by attributes.

Answer: (B)

The main idea here is who has the authority to grant or revoke access to a resource. In Discretionary Access Control, the data owner has the final say on permissions and can assign or revoke access for others. The system enforces access according to the owner’s decisions, so access decisions are driven by the owner’s discretion rather than a centralized policy. Think of a file on a computer where the owner can specify who can read or modify it and can change those permissions anytime. This is in contrast to other models: Mandatory Access Control uses system-wide labels and policies to govern access, without owner discretion; Role-Based Access Control grants access based on a user’s role; Attribute-Based Access Control uses user/resource/environment attributes to make decisions.

The main idea here is who has the authority to grant or revoke access to a resource. In Discretionary Access Control, the data owner has the final say on permissions and can assign or revoke access for others. The system enforces access according to the owner’s decisions, so access decisions are driven by the owner’s discretion rather than a centralized policy.

Think of a file on a computer where the owner can specify who can read or modify it and can change those permissions anytime. This is in contrast to other models: Mandatory Access Control uses system-wide labels and policies to govern access, without owner discretion; Role-Based Access Control grants access based on a user’s role; Attribute-Based Access Control uses user/resource/environment attributes to make decisions.