MAC

An access model where the system enforces access based on labels and clearances.

Mandatory Access Control enforces access centrally based on security labels and clearances assigned by the system, not by resource owners. Because users cannot alter permissions on their own files, it is the strictest approach and is favored in military and high assurance environments, with SELinux as a practical example. It contrasts sharply with discretionary access control, where owners grant access, and with role based access control, where permissions follow job functions. Watch for the unrelated networking and cryptographic meanings of the same three letters.