Discretionary Access Control (DAC)

Overview

Meaning and scope

Discretionary Access Control (DAC) is an access-control model in which the owner or another authorized principal can decide who receives permissions to a resource. It differs from an ACL because DAC is the governing model, while an ACL is one mechanism that can record permissions.

How it works

It should be interpreted alongside Access Control List (ACL) because the concepts can affect the same decision without representing the same control, event, or risk. The workflow establishes a trusted identity or service principal, binds authenticators, evaluates context, applies policy, and records the resulting access decision. Authorization must be enforced by the server or resource boundary on every relevant request and should not depend on hidden interface elements or untrusted client claims. In this context, organizations should constrain delegation, apply least privilege, control inheritance and sharing, review ownership changes, log grants and revocations, prevent confused-deputy behavior, and use stronger mandatory or role-based controls where owner discretion creates unacceptable risk.

Operational checks and limits

It should connect the term to Access Token where that relationship changes access, transaction treatment, investigation, communication, or recovery. Records should capture principal, authenticator or credential type, assurance level, resource, action, policy version, contextual signals, decision, failures, recovery, grants, revocations, and administrative changes. DAC lets a resource owner or permitted administrator grant access to other users, subject to the system’s rules. Permission delegation can be convenient but enables accidental over-sharing.

Practical example

A document owner gives an accountant read access to a treasury report without granting withdrawal permission.

Distinctions

DAC relies on owner-managed permissions; role-based access control assigns permissions primarily through centrally defined roles.

How to evaluate it

Security controls need defined authority and independently reviewable evidence; for Discretionary Access Control (DAC), specify the threat or failure being addressed, who can approve an exception, and which logs and artifacts will survive a system compromise. When evaluating Discretionary Access Control (DAC), tests should include false positives, unauthorized changes and recovery of normal operations; a control is useful when teams can verify its effect, not just when a configuration screen shows that it is enabled. Related concepts: Access Control List (ACL); Asset Inventory.