What is discretionary access control?
Discretionary access control (DAC) leaves access decisions to the owner of each resource. Whoever creates a file, folder or shared document normally becomes its owner and can grant or remove access for other people at their own discretion, without asking a central administrator. DAC is the default model on Windows, Linux and macOS file systems and behind the share button in most cloud storage services. The abbreviation has nothing to do with digital-to-analog converters, which share the letters.
How DAC works on real systems
The owner's choices are stored in an access control list on the object. On Windows, the owner of an NTFS file can use the Security tab or icacls to give a colleague read access:
icacls Q3-forecast.xlsx /grant CORP\jdoe:R
On Linux, the owner can add an ACL entry with setfacl -m u:jdoe:r q3-forecast.xlsx or adjust the classic owner, group and other permission bits. In cloud storage, the same decision is picking named people or an anyone-with-the-link option. In every case the person who holds the data makes the call.
Why DAC is popular and where it fails
DAC is flexible and cheap to run. People share their work when they need to, and IT doesn't become a bottleneck for every folder. Its weaknesses come from the same freedom:
- Oversharing, especially with broad groups such as Everyone or Domain Users, or through public links that travel beyond the intended reader.
- No organization-wide guarantee: a written rule that contractors can't see pricing data holds only if every owner remembers it.
- Malware running in the user's session can rewrite the permissions on anything that user owns, because the model trusts the owner's account.
- Permission sprawl, as grants pile up and nobody remembers why they were made.
Making DAC safer
Organizations keep DAC's convenience and add guardrails around it. They grant access to groups instead of individual accounts, set restrictive defaults on new folders and sites, limit or disable anonymous and external links in cloud storage, apply data loss prevention to sensitive content, and run periodic access reviews so owners confirm who still needs each grant. Least privilege still applies: DAC settles who may decide, not how generous the decision should be.
DAC vs. MAC vs. role-based access control
- Discretionary (DAC): the owner decides, resource by resource.
- Mandatory (MAC): the system enforces labels and clearances that owners can't override.
- Role-based: permissions follow the job role an administrator assigns.
NTFS permissions granted to a group that stands for a job function blur the line in practice. Follow who made the decision: an owner sharing a file is DAC, and an administrator mapping a role to permissions is role-based.
Discretionary access control on the CompTIA Security+ exam
Discretionary access control is one of the six access control models in SY0-801 objective 4.5. Clues that point to it: a file's creator decides who can open it, an employee shares a folder with a colleague directly, or permissions are set file by file on NTFS or Linux. The tempting wrong answer is usually mandatory access control, which takes the decision away from the owner; if labels or clearances appear, the answer changes. Role-based access control is the other distractor when the scenario mentions groups. For a scenario about users oversharing, expect fixes such as tighter sharing defaults and access reviews rather than a change of model.