Question

A research firm allows the creator of each project document to decide who may read or edit it, and to pass those permissions on to colleagues as they see fit. The security team notices that files are being freely shared between team members based solely on the file creators' judgment, with no central authority validating each grant. Which access control model is in use, and what is its inherent weakness in this scenario?

Accepted Answer

Discretionary Access Control (DAC); permissions propagate at owners' discretion, making enterprise-wide consistency and confidentiality hard to enforce

Answer

Mandatory Access Control (MAC); labels are assigned by the system, so owners cannot control sharing

Answer

Role-Based Access Control (RBAC); access is tied to job functions, preventing individual sharing decisions

Answer

Rule-Based Access Control; a global ruleset uniformly governs every access decision regardless of owner