Key takeaways
The four foundational access control models are mandatory access control (MAC), discretionary access control (DAC), role-based access control (RBAC), and attribute-based access control (ABAC). Each one uses a different method to decide who gets access to what.
Access control in computer security relies on three components working in sequence: authentication confirms identity, authorization determines permissions, and auditing tracks what happened.
Most organizations combine multiple access control methods. A common approach is RBAC for baseline permissions layered with ABAC policies that factor in context such as time, location, and device health.
Modern identity platforms extend these models with continuous verification, non-human identity management, and cloud-based directory services that reduce infrastructure overhead.
What is access control in computer security?
Access control determines who can view, use, or modify resources in your organization's systems. These rules and mechanisms stand between a request for access and the resource being requested. Every time someone logs in to an application, opens a file, or connects to a network, an access control decision is happening in the background.
The concept works like security levels in an office building. Some employees can access every floor. Others only access areas that relate to their specific roles. Access control applies that same logic to digital resources: files and databases, applications, network segments, and cloud services.
Two terms appear throughout access control systems:
Subjects: the entity requesting access. That could be a person, a device, an application, or an automated process.
Objects: the resource being accessed, such as a database, a file server, or a SaaS application.
Every access control decision evaluates whether a specific subject should be allowed to access a specific object.
Organizations with effective access controls limit their exposure to data breaches, meet compliance requirements, and keep operations running smoothly. Organizations that get them wrong leave sensitive resources open to unauthorized users, giving both internal users and unauthorized attackers more permissions than they need.
What are the components of access control?
Every access control system relies on three components working in sequence. Different models of access control handle the second step, authorization, in different ways.
Authentication
Authentication is the process of verifying that a subject is who or what it claims to be. Any access control system must verify identity before it can decide on granting or denying access.
Authentication methods fall into three categories:
Something you know, like a password or PIN.
Something you have, like a phone receiving a push notification or a hardware security key.
Something you are, like a fingerprint or facial scan.
Multi-factor authentication (MFA) combines two or more of these categories so that a compromised password alone is not enough to gain entry.
Authentication verifies the subject's identity, but it does not decide what they are allowed to do.
Authorization
Identity confirmed? Now, authorization determines what they are permitted to access. A subject might prove they are a legitimate employee, but can they access payroll or execute a wire transfer? Only a handful of people with confirmed identities can do that.
This is where access control models come in. MAC, DAC, RBAC, and ABAC each take a different approach to making authorization decisions. Some rely on centrally assigned labels. Others evaluate job roles. Others weigh multiple attributes in real time. This article will explore these different approaches in greater detail.
Management and auditing
Management is the ongoing process of creating, modifying, and revoking access permissions. When employees join an organization, change roles, or leave, their access permissions should change as quickly as possible. Otherwise, users end up with access they no longer need.
Auditing tracks what actually happened. It records what users access, what they did, and whether they failed. This record supports compliance reporting, incident investigation, and quickly catching unauthorized access. Together, management and auditing form the access control governance layer that keeps the system effective over time.
What are the 4 types of access control models?
The four foundational types of access control models are:
Mandatory access control (MAC)
Discretionary access control (DAC)
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Each model takes a fundamentally different approach to authorization. Organizations choose access control models based on their security requirements, the flexibility their teams need, and the compliance obligations they face.
How does mandatory access control (MAC) work?
In a mandatory access control model, organizations assign every resource a security label that indicates its sensitivity. Labels follow a hierarchy, such as Unclassified, Confidential, Secret, and Top Secret. Others are applied automatically based on classification rules, such as tagging a file as Confidential when it contains financial data. Every subject requesting access—whether a person, a service account, or an automated process—receives a clearance level. The system compares the two on every request. A subject with Secret clearance can access resources labeled Secret or below, but not higher classifications such as Top Secret.
Unlike different types of access control, the defining characteristic of MAC is that users have no say in the matter:
They cannot grant access to another person, reclassify a document, or override the system's decision.
Only system administrators with the appropriate authority can change labels or clearance levels.
This rigidity makes MAC well suited for environments where data leakage could have severe consequences.
Government and military agencies use MAC to protect classified information. Healthcare organizations apply MAC to psychiatric and substance abuse records that carry additional regulatory protections. Financial institutions use it for systems subject to strict separation-of-duty requirements.
How does discretionary access control (DAC) work?
DAC puts access decisions in the hands of the people who own the resource. When you create a document on your computer and share it with a colleague, you are using discretionary access control. The operating system lets you decide who can read, write, or execute that file, and you can change those permissions at any time.
Most personal computers and collaborative file-sharing tools use DAC by default. It is easy to understand, easy to implement, and gives teams the flexibility to share information quickly. The trade-off is security. Because any owner can grant access to anyone, DAC is vulnerable to human error. An employee might accidentally share a sensitive file with the wrong distribution list, or a malicious program might inherit the access rights of the user who launched it.
DAC works well for small teams and environments where ease of collaboration matters more than tight control. As organizations grow, the decentralized nature of DAC makes it harder to enforce consistent policies across thousands of users and resources.
How does role-based access control (RBAC) work?
RBAC assigns permissions to roles, rather than individual users. An administrator defines a set of roles that mirror the organization's job functions. The "HR Manager" role might include access to payroll systems, employee records, and benefits platforms. The "Sales Rep" role might include access to the CRM, proposal templates, and territory dashboards. When a new HR Manager joins the organization, an administrator assigns them the role, and they automatically inherit every permission attached to it.
This approach scales efficiently. Instead of configuring access for each of 5,000 employees individually, an administrator manages perhaps 50 roles. Roles can also form hierarchies. A "Manager" role might inherit all permissions of the "Employee" role and add additional ones like approving time-off requests and viewing team performance reports.
RBAC supports the principle of least privilege, which means granting users only the permissions they need to do their job and nothing more. It is the most widely adopted access control model in enterprise organizations, particularly in industries like healthcare (where doctors, nurses, and administrators need clearly separated access) and financial services (where separation of duties is a regulatory requirement).
How does attribute-based access control (ABAC) work?
ABAC makes access decisions by evaluating a range of factors. ABAC policies consider four categories:
User attributes include details like department, clearance level, and job title
Resource attributes describe the data being requested, such as its classification or owner
Action attributes specify what the user wants to do, like read, write, or delete
Environment attributes capture context, such as the time of day, the user's location, and the security posture of their device
An ABAC policy combines these attributes into rules. For example: it may allow access if the user is in the Finance department, the resource is classified as internal, the action is read-only, and the request originates from the corporate network during business hours. But the same user, same desk, same file, at 11 p.m.? Denied. This makes ABAC the most granular and context-aware model available.
This flexibility comes at a cost. ABAC policies require careful design and ongoing maintenance. Organizations need a reliable source of attribute data and a policy engine capable of evaluating multiple conditions in real time. Cloud-native companies, zero trust architectures, and organizations with complex compliance requirements are the most common adopters.
How do the four access control models compare?
Table 1: control and flexibility
Model | Characteristics | Best for |
|---|---|---|
MAC - System administrators control access | Low flexibility Very high security | Government, military, regulated industries. |
DAC - Resource owners set permissions | High flexibility Medium security | Small teams, personal computing, collaboration tools. |
RBAC - Administrators define roles | Medium flexibility High security | Enterprises with defined job functions |
ABAC - Complex policy-based rules | Very high flexibility High security | Cloud, zero trust, complex dynamic environments |
Many modern organizations combine multiple models. They may apply RBAC for baseline permissions layered with ABAC policies that add context-aware decisions on top. An organization might also apply MAC to a specific subset of highly sensitive data while using RBAC everywhere else.
What is the difference between logical access control and physical access control?
There are two broad access control categories: logical and physical. The four models described above apply to logical access control, which protects digital resources. They can also impact physical access control, which protects physical spaces and tangible assets.
What is logical access control? Logical access control governs who can reach files, databases, applications, networks, and APIs. It is enforced through login screens, permission systems, firewalls, and policy engines.
Physical access control governs who can enter buildings, server rooms, data centers, and restricted areas. It is enforced through hardware and personnel such as badge readers, biometric scanners, security cameras, and on-site guards.
The two categories increasingly overlap. RBAC concepts apply to physical security when badge access is assigned by job role. ABAC concepts apply when a building's entry system considers time of day and the employee's department before unlocking a door. Organizations with strong security postures treat logical and physical access control as parts of the same system rather than managing them separately.
What additional access control methods should I know?
MAC, DAC, RBAC, and ABAC are the foundational models of access control. Two additional access control techniques appear often enough in security literature that they are worth understanding.
Rule-based access control
Rule-based access control applies a uniform set of rules to all users, regardless of role or identity. A rule might state that no one can access financial systems outside of business hours or that all traffic from a specific IP range is blocked. Rules function as blanket restrictions layered on top of another model. A firewall that blocks certain ports or a system that locks accounts after five failed login attempts uses rule-based access control.
Rule-based access control differs from RBAC despite the similar name. RBAC assigns permissions based on job function. Rule-based access control enforces fixed conditions that apply to everyone equally. It differs from ABAC in scope. ABAC evaluates many attributes per request and can produce dynamic, context-sensitive decisions. Rule-based access control applies the same static rule to every request.
Organization-based access control
Organization-based access control (OrBAC) extends RBAC by adding organizational context to access decisions. Where RBAC asks "What is this user’s role?" OrBAC also asks "Which organization or unit do they belong to, and what is the context of the request?".
A hospital using OrBAC might allow doctors to access patient records, but only for patients assigned to their department. A multinational corporation might allow regional managers to access data only for their own geography. OrBAC is less common than the four primary models, but it is useful in complex organizational hierarchies where the same role title carries different permissions depending on the unit.
What is involved in implementing access control in your organization?
Choosing a model is the starting point. Implementing it requires a systematic approach that accounts for your current state, your compliance requirements, and the day-to-day experience of the people using your systems.
1. Assess your current access control mechanisms
Conduct an access audit that answers four questions:
Who currently has access to sensitive systems and data?
Are permissions aligned with current job roles?
Do former employees or contractors still have active accounts?
Are there shared accounts or permissions that are broader than necessary?
Note the gaps that a new or improved access control model needs to close. This gives you a baseline for measuring progress after implementation.
2. Choose the right access control model for your needs
The right model depends on your organization’s size, the regulations that apply to your business, the sensitivity of the data you manage, and the user experience you want to deliver.
Most organizations benefit from using RBAC as a foundation, layering in ABAC policies for context-aware decisions. This structure provides both scalability and granularity.
The most regulated industries may require MAC for certain secure systems.
Modern identity platforms support multiple models simultaneously, so the choice is not always one or the other.
3. Implement multi-factor authentication
Multi-factor authentication (MFA) belongs in every access control implementation, regardless of which model you choose. MFA requires users to verify their identity through two or more factors before gaining access, preventing attackers from using compromised passwords to access systems.
Duo’s phishing-resistant MFA uses secure Bluetooth to prevent remote threats, all in a user-friendly and easy-to-deploy platform.
4. Define clear access policies and roles
Document who should have access to which resources and under what conditions. For RBAC, this means mapping job functions to roles and assigning the minimum permissions each role requires. For ABAC, it means writing policies that specify which attributes the system should evaluate and what thresholds trigger denial. Involve stakeholders from IT, security, HR, and the business units whose resources are being protected.
5. Monitor access and conduct regular audits
An access control system is not a one-time deployment. Permissions drift as people change roles, new applications are added, and business requirements evolve. To keep the system accurate, implement access control governance with continuous monitoring and regular reviews.
Track all access attempts, both successful and failed. Alert on anomalous behavior such as access from an unusual location or an unexpected time. Review and revoke unnecessary permissions on a regular cycle. Automate permission removal when employees change roles or leave the organization.
What are some real-world access control system examples?
Access control models are easier to evaluate when you can see them applied to real environments. Here are five scenarios that illustrate how different organizations put these models to work:
Healthcare organization
Doctors, nurses, and administrative staff each have distinct access to electronic health records through RBAC. Psychiatric and substance abuse records carry additional MAC protections to meet HIPAA requirements. The two models run in parallel across the same infrastructure.Financial services firm
RBAC provides baseline permissions across departments. ABAC policies layer on top so that traders can access trading systems only from approved devices during market hours. After-hours access triggers additional verification.Technology startup
A ten-person team uses DAC for collaborative file sharing, giving each team member discretion over the documents they create. As the company scales past 100 employees, the team plans to transition to RBAC for consistency.Government agency
MAC governs all systems handling classified information. Every document, database, and communication channel carries a security label. Clearance-based access is the only path in and no individual user can override the policy.Cloud-native company
ABAC powers every access decision in a zero trust architecture. The policy engine evaluates device health, user location, resource sensitivity, and time of request before granting access. No implicit trust exists based on network location.
Why access control matters now
Identity-related attacks are growing in frequency and cost. Access control is the primary defense between an attacker and the resources they target.
1. Verizon, "Additional 2025 DBIR research on credential stuffing"; 2. Gartner; 3. IBM Cost of a Data Breach Report 2025.
How can modern access management controls strengthen security?
The foundation of access control in computer security uses four models, but the environments they protect have changed. Cloud adoption, remote work, and the growth of automated systems mean that static permission systems alone are no longer enough. Modern identity platforms strengthen cyber security access control. They build on MAC, DAC, RBAC, and ABAC by adding capabilities that the original models were not designed to handle.
Continuous verification replaces the single checkpoint
Traditional access control checks identity once at login and then trusts the session. Modern platforms verify continuously throughout the session, re-evaluating risk signals like device health, network location, and user behavior continuously and in real time. This approach aligns with zero trust security principles, a security framework built on the idea that no user, device, or connection should be trusted by default, even inside the corporate network. Every access request is evaluated independently.
Non-human identities need the same controls as human ones
Service accounts, API keys, AI agents, and automation bots all require verified identities and appropriate access permissions. These NHIs now outnumber human users in most organizations by a wide margin. Yet traditional access control models were built for people not pipelines.
Duo Directory manages NHIs with the same lifecycle controls that apply to human users across provisioning, permission assignment, regular review, and deactivation. As automated workloads grow and machine-to-machine connections multiply, keeping NHIs under the same governance framework as human ones is no longer optional.
Where is access control headed?
Access control is moving away from static, point-in-time decisions toward continuous, context-aware verification. The perimeter-based model—where users are trusted once they're inside the network—no longer reflects how organizations operate. Cloud adoption, remote work, and the explosion of NHIs have made old assumptions obsolete.
The direction is clear: every access request, from every identity type, needs to be evaluated in real time against a dynamic set of signals, including device health, location, behavior, and risk score. Trust is never assumed. It is earned on every request and re-evaluated throughout the session.
Duo Directory is built for this future. Its adaptive access policies evaluate risk signals at the moment of every request, device trust verification confirms the security posture of endpoints before granting access, and its cloud-based architecture scales across human and NHIs without requiring forklift migrations or parallel directory maintenance.
Identity orchestration simplifies multi-directory environments
Many organizations operate several identity stores at the same time—such as an on-premises Active Directory instance, a cloud identity provider, a separate directory for contractors, or application-specific user databases.
Identity orchestration coordinates authentication across all of them from a single control point. Instead of maintaining parallel directories, organizations define routing rules that send each login request to the right source automatically.
Duo simplifies secure access by combining identity management with access control. The platform enables phishing-resistant MFA, device health verification, and adaptive access policies while supporting both RBAC and ABAC implementations—all while keeping the user experience simple.
Duo Directory is Cisco's cloud-based identity platform. It can serve as a standalone directory or work alongside existing Active Directory deployments through directory sync. It supports passwordless authentication, automates user lifecycle management through the SCIM 2.0 standard (a protocol for automatically provisioning and deprovisioning user accounts across systems), and provides dynamic routing rules for managing multiple authentication sources.
Organizations can bring their existing directories with them and add cloud-based identity management on top. No forklift migration required.
Ready to strengthen your access control with a comprehensive identity security platform?
Start your free trial of Duo Security today.