About this interactive
Six access control models, six decision rules, one pairing each. The reason this is worth drilling rather than reading is that the names collide: discretionary and mandatory are opposites that sound like a matter of degree, and rule-based, role-based and risk-based are three different models separated by a single syllable. Match on the mechanism and the names sort themselves out. Discretionary access control puts the decision in the hands of the people who already have the resource. A finance share whose members hold full rights can have its permissions changed by those members, so when a report needs to go to the sales team, the finance team opens the folder themselves. That convenience is the whole model and also its whole risk. Mandatory access control is the opposite end of the same axis: the users of a resource can read and create within it but cannot change who else gets in. Someone who wants access has to go to a designated authority — IT, or whoever is put in charge of that particular resource. Note what the distinction is not about. It is about who holds the power to grant, not about how sensitive the data is. Role-based access control is the one you will be asked about in a security assessment. Permissions are attached to a role, people are attached to the role, and nobody is granted anything directly. The payoff shows up on the day someone changes jobs: remove them from the accountant role and every finance resource closes at once, then add their replacement and everything they need opens at once. Grant on individual folders instead and a departure or a transfer leaves permissions behind on the resources you forgot to check. Rule-based access control decides by predefined condition, evaluated the same way for everyone. A firewall is the canonical example — a rule admits traffic from any IP address to one port on one server, and nothing about the requester's identity enters into it. This is what makes it workable for anonymous traffic, where role-based and discretionary have nothing to key on. Attribute-based access control looks similar and is not: the decision keys on a characteristic the user carries, such as their department, their physical location, their reporting manager, or the shift they work. Rule-based asks what the request is; attribute-based asks who the requester is, in more dimensions than a single assigned role can express. Risk-based access control is the one that changes its mind. Rather than a fixed grant, it evaluates the risk of the request at the moment it is made and adjusts accordingly — a user whose password fails a strength check can lose access to sensitive resources until they fix it, and regain it without an administrator touching anything. The last thing to carry out of this activity is that these are not alternatives to choose between. A real organization typically runs rule-based on its firewalls, role-based across its directory, discretionary on some shared resources, and mandatory on the ones that matter most, all at the same time. The question in practice is never which model the company uses; it is which model is deciding this particular request.
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →