Discretionary Access Control (DAC)

What is discretionary access control (DAC)?

Discretionary access control (DAC) is an access control model in which the owner of a resource decides who else may access it and at what level. The decision is discretionary because it belongs to the user holding the object, not to a central administrator. Formalized in the US Department of Defense Trusted Computer System Evaluation Criteria, DAC remains the default model in file systems and in nearly every SaaS sharing feature.

How DAC works

• Every resource has an owner, usually the user who created it.
• The owner grants or revokes permissions to other users or groups, generally through an access control list.
• Permissions can propagate: a user who receives access can often share it onward.
• Ownership can be transferred, which moves the decision rights along with it.
• No central policy validates the grant before it takes effect.

Why your SaaS estate runs on DAC whether you chose it or not

Every time an employee shares a Google Doc, invites a guest into a Notion workspace, or adds an external partner to a Slack channel, the company is applying discretionary access control. IT did not approve that decision and usually cannot see it. This is the quiet reason access sprawl grows faster than headcount: the grant path is decentralized by design, while the audit obligation stays central.

Examples and use cases

An engineer creates a Confluence space for a client project and invites two colleagues. One of them adds a contractor, who adds a second contractor. Four people now hold access and none of those grants passed through IT. Under ISO 27001 and NIS2, the company still has to evidence who can reach that data. The workable answer is not to ban sharing but to make it visible and reviewable, which is what Corma does by pulling those grants from each application into a single recurring review.

Related concepts

• Automated identity governance and administration
• Full visibility to prevent shadow IT
• IAM for security teams

FAQ

What is the difference between DAC and MAC?

In DAC the resource owner decides who gets access. In mandatory access control the system enforces a central policy based on classification labels, and users cannot override it.

Is DAC less secure than other models?

It is more flexible and harder to control. Its structural weakness is propagation: access granted by one user can be re-granted by the next, with no central checkpoint.

Is RBAC a form of DAC?

No. RBAC assigns permissions through roles defined centrally. DAC leaves the decision to whoever happens to own the resource.

How do you keep DAC under control?

By discovering grants continuously across applications, asking owners to recertify them on a schedule, and removing guest and external access once it has served its purpose.

Request a demo