Three organizations get the same request: an employee wants to open a spreadsheet. At a defense contractor, a label on the file and a clearance on the employee decide it, and nobody can override the answer. At a startup, the spreadsheet's owner shares it with whoever asks. At a hospital, the employee's job role decides it, but only during her shift. Same request, three different ways of deciding it.
On the CompTIA Security+ SY0-801 exam, access control models are part of objective 4.5, which lists six of them: role-based, rule-based, mandatory, discretionary, time-based and just-in-time. Questions describe how access is granted and ask you to name the model or pick the right one for a situation. This lesson explains who makes the decision in each model, how each is built on real systems, and the policies that sit behind every access decision.
Access management pairs authentication with business and technical policy
Access management has two halves. Authentication establishes who is asking, which the earlier lessons in this section covered. Policy decides what that identity may do. SY0-801 separates policy into two kinds, and the difference shows up in scenario questions.
Administrative or business policies are rules written and approved by management. They say who may request access, who must approve it, how often access is reviewed, and which combinations of duties no single person may hold. "The data owner approves every request for access to customer records" and "no one may both create vendors and approve payments" are administrative policies. They live in documents, procedures and approval workflows.
Logical or technical policies are the settings systems enforce: file ACLs, Group Policy password and lockout settings, firewall rules, conditional access policies and cloud IAM policy documents. They act on every request automatically, whether anyone remembers the written rule or not.
The two should match. The business policy says contractors may not touch production data, and a technical policy, such as a group exclusion or a conditional access rule, makes that true. Auditors look for gaps in both directions: a written rule that nothing enforces, and a technical setting that no approved policy explains. The access control models below are the frameworks those technical policies follow.
Discretionary access control lets the owner decide
In discretionary access control (DAC), the owner of a resource, usually whoever created it, decides who else can use it. It's the model behind NTFS permissions, Linux file permissions and the share buttons in cloud file services. On Linux the owner can widen access with one command:
$ ls -l q3-forecast.xlsx
-rw-r----- 1 mlopez finance 48211 Oct 21 09:14 q3-forecast.xlsx
$ chmod o+r q3-forecast.xlsx # owner lets every other user read it
DAC is flexible and needs no central administrator for everyday sharing, which is why it's the default on most operating systems. Its weakness is that security depends on every owner's judgment. Users overshare, "anyone with the link" spreads, and malware running under a user's account inherits that user's power to change permissions on everything the user owns. Nothing in the model enforces an organization-wide rule.
On the exam, wording such as "the owner grants access", "users share their own files" or "the creator sets permissions" points to DAC.