What Is Discretionary Access Control (DAC)?

Discretionary access control (DAC) is an access control model where the owner of a resource decides who can access it and what permissions they receive. Unlike centrally enforced models, DAC gives individual users discretion over sharing their own files, folders, or systems. This model is common in everyday operating systems, where file owners can grant or revoke access to other users.

DAC offers flexibility, since resource owners can adjust permissions without administrator involvement. However, this same flexibility introduces risk, since access decisions are decentralized and depend on individual judgment rather than consistent organizational policy.

How Does Discretionary Access Control (DAC) Work?

DAC operates through ownership-based permission assignment.

• Ownership assignment: A user or system is designated as the owner of a resource, typically the creator.
• Permission granting: The owner decides which other users or groups can read, write, or execute the resource.
• Access enforcement: The operating system or application checks these owner-defined permissions before granting access.

Common examples include file-sharing permissions in Windows or Linux, where users can directly modify who else can view or edit their files.

DAC vs Other Access Control Models

DAC prioritizes user flexibility, while MAC and RBAC prioritize centralized, consistent policy enforcement.

Why Discretionary Access Control Matters for Enterprise Security

DAC’s flexibility becomes a liability at enterprise scale. Since individual users control permissions, security teams lose visibility into who has access to what, making audits and compliance reporting significantly harder.

Insider threats and accidental oversharing are more likely under DAC, since no centralized authority reviews every permission change. This is why most enterprises layer additional controls, or move away from DAC entirely, for sensitive systems.

How Hexnode Enforces Centralized, Auditable Access Control

Rather than relying on discretionary, owner-based permissions, Hexnode UEM uses Role-Based Access Control (RBAC) to govern who can access and manage the console. Administrators can assign predefined roles or create custom roles that define exactly which tabs, actions, and device scopes a technician can access. This centralized model removes the unpredictability of DAC by ensuring every permission is explicitly defined and reviewable by administrators, rather than left to individual discretion.