Editing Discretionary access control (section)

{{Short description|Type of access control}}

In [[computer security]], '''discretionary access control''' ('''DAC''') is a type of [[access control]] defined by the [[Trusted Computer System Evaluation Criteria]]<ref>
{{ cite book
 |title       = Trusted Computer System Evaluation Criteria
 |publisher   = United States Department of Defense
 |date        = December 1985
 |url         = http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html
 |id          = DoD Standard 5200.28-STD
 |url-status     = dead
 |archiveurl  = https://web.archive.org/web/20060527214348/http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html
 |archivedate = 2006-05-27
}}</ref> (TCSEC) as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong.  The controls are [[wikt:discretionary|discretionary]] in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by [[mandatory access control]]).

Discretionary access control is commonly discussed in contrast to [[mandatory access control]] (MAC).  Occasionally, a system as a whole is said to have "discretionary" or "purely discretionary" access control when that system lacks mandatory access control.  On the other hand, systems can implement both MAC and DAC simultaneously, where DAC refers to one category of access controls that subjects can transfer among each other, and MAC refers to a second category of access controls that imposes constraints upon the first.