Discretionary Access Control (DAC)

Discretionary Access Control is the default model in most general-purpose operating systems: file or object owners hold the authority to grant or revoke permissions to other users and groups, typically through ACLs or POSIX read/write/execute bits. Because trust flows from the owner, permissions can be propagated freely, which is convenient for end users but makes the system vulnerable to malware running with the user's privileges and to confused-deputy or Trojan-horse attacks. DAC is well-suited to collaborative environments and personal data but is considered insufficient for highly classified information, where MAC or strict RBAC/ABAC layered on top is required.