Mandatory Access Control (MAC)

What is mandatory access control (MAC)?

Mandatory access control (MAC) is an access control model in which a central authority defines the policy and the system enforces it, with no ability for users or resource owners to override it. Access is decided by comparing a subject clearance against an object classification label. The model originates in defense computing and appears today in SELinux, AppArmor, and highly regulated environments.

How MAC works

• Every object carries a classification label, for example public, internal, confidential, or restricted.
• Every subject carries a clearance level and, in some models, a set of compartments.
• Access is granted only when the clearance dominates the classification.
• The Bell-LaPadula model adds directional rules: no read up, no write down.
• Only a security administrator can change a label, never the file owner.

Where MAC logic reappears in a SaaS company

Very few SaaS applications implement true MAC. What carries over is the logic: data classification driving access rather than individual goodwill. Organizations under NIS2, DORA, or ISO 27001 are effectively asked to prove that access to sensitive categories follows a documented policy instead of a chain of ad hoc shares. That is MAC thinking applied to a discretionary world.

Examples and use cases

A healthcare software company classifies patient data as restricted and marketing content as internal. Its policy states that only staff with a named clearance and a business justification may reach restricted systems. The technical enforcement lives inside each application, so the compliance work becomes proving that every one of them matches the stated policy. Assembling that evidence across the whole application estate is exactly the exercise Corma automates for access reviews.

Related concepts

• Automated identity governance and administration
• Identity and access management platform
• IAM for security teams

FAQ

What is the difference between MAC and DAC?

MAC enforces a central policy through labels and clearances that users cannot change. DAC lets the resource owner decide who gets access, with no central checkpoint.

Where is MAC actually used?

In defense and intelligence systems, in SELinux and AppArmor on Linux, in hardened database and operating system configurations, and in specialized regulated platforms.

Is MAC the same as ABAC?

No. ABAC evaluates many attributes at run time and is far more flexible. MAC relies on a fixed hierarchy of labels and clearances that only a security administrator can modify.

Does the GDPR require mandatory access control?

No. Article 32 of the GDPR requires appropriate technical and organizational measures. Classification-driven access is one accepted way to demonstrate that, not a named obligation.

Request a demo