ISC Access Control · Updated November 2026
RBAC, ABAC, DAC, MAC: What Decides Access?
Focus on what the authorization decision is based on: role, attributes, owner discretion, or mandatory classification.
RBAC
Role-Based Access Control assigns permissions based on job roles.
ABAC
Attribute-Based Access Control can consider user, resource, location, time, device, risk, and other attributes.
DAC
Discretionary Access Control gives resource owners discretion over who receives access.
MAC
Mandatory Access Control follows centrally enforced security labels and classification rules.
The takeaway
Role, attributes, owner discretion, or mandatory classification. Identify what drives permission.
Related Summit guides
FAQ
Is RBAC based on job function?
Yes.
Can ABAC use time and location?
Yes.
Does MAC give resource owners broad discretion?
No.