Mandatory Access Control (MAC)

Overview

Mandatory access control is an access-control model in which a central authority defines security labels and rules that users and ordinary resource owners cannot freely change.

Mandatory Access Control (MAC) is closely connected to Policy-Based Access Control (PBAC), Security Assertion Markup Language (SAML), and Security Architecture Review. It differs from discretionary access control because access decisions are enforced by system policy rather than by the owner of each file or object.

Operational implementation should define classifications and clearances, apply least privilege, control label changes, separate administrative roles, test information flows, log denials, and govern exceptions through formal authorization.

The principal failure modes include incorrect labels, excessive privileges, administrator bypass, incompatible applications, hidden data flows, over-restrictive rules, and exceptions that become permanent.

Useful measures include policy coverage, denied-access anomalies, privileged label changes, exception age, and unauthorized information-flow findings.

Operationally, teams should define classifications and clearances, apply least privilege, control label changes, and separate administrative roles. Key risks include incorrect labels, excessive privileges, administrator bypass, and incompatible applications.

For Mandatory Access Control (MAC), the trust decision should establish an access-control model in which a central authority defines security labels and rules that users and ordinary resource owners cannot freely change and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for an access-control model in which a, rather than checking only a successful request. Logs concerning the Mandatory Access Control context and an access-control model in which a should support investigation without exposing reusable secrets or unnecessary personal data.