Explain like I'm five · InfoSec

What are Access Control Models?

Access control models — DAC, MAC, RBAC — told as a story about three different rules for who decides a room's key.

①②③the owner gives his room's key to anyone he likesthe king's rank-list decides who entersa key ring for each hat (role)every room decides who gets a key by a different rule

Every room decides who gets a key by a different rule.Some rooms let the owner choose, some follow the king's rank-list, some follow the hat (role).

the owner gave out a key — to the king's secret roomnobody had decided which rule this room should followdecide per room which rule applies first — the rules are DAC, MAC and RBAC

Leave a room's rule undecided, and the rules collide into an accident.The owner freely handed out a key — to what turned out to be the king's secret room. Each room's rule has to be decided first.

DACthe room's owner decidesMACthe king's rank-list — even the owner can't override itRBACkeys go to the hat (role)an access-control model = a rule for who gets to decide who holds the keys

An access-control model is a rule for who gets to decide the keys.MAC's rank-list has its own precise rules, and RBAC is already covered in a key ring for every hat.

DACthe room's owner decides directly
MACthe king's rank-list — not even the owner can override it
RBACkeys go to the hat (role)
Mixed in practiceone castle may run all three models together
modelwho decidesexampleDACthe resource's ownersharing a fileMACcentral rank-list — owners can't change itmilitary/classified systemsRBACthe admin who defines the role (hat)common in company systems

Here are the three models side by side: who decides, with an example of each.Different decision-makers mean different flexibility and risk. When studying for the exam, compare the three by who decides.

DAC is flexible, but owners easily give keys to the wrong personMAC is strict, but owners can't adjust the rank-list to adaptso many castles mix in role-based (RBAC) and attribute-based (ABAC) rules too

One model alone often isn't enough.In practice, castles blend several models. → RBAC, ABAC; MAC's precise rules are covered in BLP/Biba.

In one breath

An access-control model is a rule for who decides the keys. DAC lets the owner decide, MAC follows a fixed rank-list, RBAC assigns by hat (role).

Discretionary Access Control (DAC) lets the resource owner grant permissions at their own discretion; Mandatory Access Control (MAC) enforces centrally fixed security labels that not even the owner can override; Role-Based Access Control (RBAC) binds permissions to roles and assigns users only a role. When studying for the exam, compare the three by who decides, how flexible each is, and where each is typically applied.

When grown-ups say it

Discretionary Access Control
The room's owner decides directly. Flexible — but one owner's mistake becomes an incident immediately.
Mandatory Access Control
The king's rank-list — not even the owner can override it. Its precise read/write rules live in their own page. → Access-control security models (BLP/Biba)
Role-Based Access Control
Keys go to the hat (role), not the person. Commonly used in company systems. → a key ring for every hat
Attribute-Based Access Control
The gatekeeper's if-sentence. Combines several tags (attributes) into one condition. → the gatekeeper's if-sentence
Security label
The king's rank stamp. A fixed rank attached to both the room and the person, under MAC.
Least privilege
Only the key you actually need. A principle every model should still follow. → only the key you need
Audit
Checking who holds a key, and why. A clear rule is what lets the inspector check it at all. → the inspector from the neighboring kingdom
Hybrid model
A castle running all three together. Real organizations blend DAC, MAC, RBAC and ABAC, each where it fits.
Next story
The Pass Several Kingdoms Agreed to Honor →
Want another term as a picture book? Request →