Graham-Denning: The Eight Protection Rules

The Graham-Denning model is a foundational access control framework that defines how systems create, manage, and control access to objects and subjects. Unlike confidentiality-focused models like Bell-LaPadula or integrity models like Biba, Graham-Denning answers a different question entirely: who has the authority to grant or revoke access rights in a secure system?

The model provides eight fundamental operations that govern access control management. It is especially valuable in distributed and multi-user environments, where control over permissions matters just as much as the permissions themselves. For CISSP candidates, Graham-Denning is essential Domain 3 (Security Architecture and Engineering) material, particularly for questions about how access control decisions are made and delegated.

What is the Graham-Denning Model?

The Graham-Denning model is a formal security model that specifies how access control should be managed in a secure computing environment. Other models define what access is permitted: Bell-LaPadula’s confidentiality rules, Biba’s integrity rules. Graham-Denning defines how access rights come into existence, change hands, and disappear.

Think of it this way. Bell-LaPadula tells you that a Secret-cleared user cannot read Top Secret documents. But who decided that user gets Secret clearance in the first place? Who can grant them access to specific documents? Who can take that access away? Those are the questions Graham-Denning answers.

The model is particularly relevant where access control decisions are distributed: cloud platforms, enterprise networks, multi-tenant systems. Those environments need formal rules for how administrators create accounts, how managers delegate permissions to their teams, and how ownership of resources transfers when people change roles.

Subjects and Objects

Graham-Denning operates on three core components. Understanding them is essential before the eight operations make sense.

Subjects: The Active Entities

A subject is any active entity that can perform actions in the system: users logged into their accounts, running applications, background processes. Subjects are the actors that initiate operations and request access to resources.

Objects: The Passive Resources

An object is any passive resource that subjects interact with: files, databases, printers, network resources, and even other subjects when they are being acted upon. Objects are the targets of access requests.

The same entity can be both, depending on context. When you open a document, you are the subject and the document is the object. When a backup process copies files, the process is the subject and the files are objects. And a user account is an object while an administrator is creating it, then becomes a subject the moment that user logs in and starts accessing files.

Access Rights: The Permissions

Access rights define what a specific subject can do with a specific object: read it, modify it, delete it, or control who else can access it.

Key concept: the access control matrix. Graham-Denning tracks every subject-object relationship in an access control matrix. Each cell holds the rights a specific subject has over a specific object. The eight operations defined by the model are the only ways to modify this matrix. That closed set of operations is what makes the model formally analysable: if an operation is not one of the eight, it cannot change who has access to what.

The Eight Operations

Graham-Denning defines exactly eight operations, falling into two groups: entity operations that manage the lifecycle of subjects and objects, and access right operations that control the permissions between them.

Entity Operations (1 to 4)

The first four operations handle entity lifecycles: creating and deleting the subjects and objects that exist in the system.

Access Right Operations (5 to 8)

The remaining four operations manage the permissions themselves: how rights are examined, granted, revoked, and delegated.

CISSP Exam Note. Watch the distinction between Read Access Right and reading an object’s content. Reading an access right means checking the permissions table to see who holds what access. It does not mean reading the file itself. It is an administrative operation on the access control matrix, not a data access operation, and the exam uses that ambiguity deliberately.

Operations in Action: A Cloud Example

Here is how the operations combine in practice. A cloud administrator creates a secure storage container for financial records: that is Create Object. They give the automated billing service access to it: Grant Access Right.

A security auditor arrives to verify compliance and checks the access control lists to see who is authorized: Read Access Right. The billing service is later replaced, so the administrator revokes the old service’s permissions: Delete Access Right.

Finally, the administrator goes on leave and uses Transfer Access Right to delegate access management authority to a senior analyst. Between them, the eight operations cover the entire lifecycle of subjects, objects, and the access relationships connecting them.

Control Rights and Ownership

The eight operations do not float free: specific control rights determine who may perform them. Ownership and the transfer attribute are what make the model work in practice.

Ownership: The Foundation of Control

When you create an object, you become its owner with full control rights. As owner, you can grant others access and specify whether they can pass those rights further. Ownership is the root of all access control authority in Graham-Denning: every permission in the system traces back, through some chain of grants and transfers, to whoever created the resource.

Key concept: owner privileges. The owner of an object has complete authority over it: granting access, revoking access, and even transferring ownership itself. This creates a clear, auditable chain of authority anchored to the object’s creator.

The Transfer Attribute

A right can be granted with or without a transfer attribute. Granted with transfer, the receiving subject can pass that same right on to others, creating a hierarchy of authority and enabling delegation through the system. Granted without transfer, the right stops with its recipient.

Crucially, transfer does not mean the owner surrenders control. The original owner retains ultimate authority and can revoke any right at any time, no matter how many hands it has passed through. The transfer attribute enables controlled delegation while preserving accountability.

Consider a legal department. The legal director creates a contracts repository and becomes its owner. They grant junior staff read access without transfer: staff can view contracts but cannot share access with anyone else. They grant senior lawyers read access with transfer, so those lawyers can bring in external consultants as a matter needs. The director keeps ultimate control while delegation happens at the right level.

CISSP Exam Note. The transfer attribute creates a delegation chain, but the original owner always retains the ability to revoke any right, including rights transferred multiple times down the chain. Ownership trumps delegation. If an exam option implies a transferred right escapes the owner’s control, it is wrong.

Practical Applications

Knowing where Graham-Denning shows up in real systems makes the abstract operations concrete, and builds the pattern-matching that questions in this area tend to reward.

Enterprise Access Management

In enterprise environments, Graham-Denning principles run through identity and access management (IAM). When an HR administrator creates a new employee account (Create Subject), grants them access to departmental resources (Grant Access Right), and later revokes that access on termination (Delete Access Right), they are executing Graham-Denning operations, whether or not anyone in the room has heard the model’s name.

Cloud and Multi-Tenant Systems

Cloud platforms implement Graham-Denning concepts when managing permissions across tenants. Each tenant can create resources (Create Object), share them with other users (Grant Access Right), and audit who has access (Read Access Right). The platform’s job is to ensure tenants can only manage permissions for their own resources: ownership boundaries enforced at scale.

Comparison with Other Models

Important distinction. Graham-Denning does not compete with the other models; it complements them. You might use Bell-LaPadula to define the confidentiality rules and Graham-Denning to specify how those rules are established, delegated, and maintained. They address different layers of a complete security architecture: one sets the policy, the other governs the machinery that administers it.

Conclusion

The Graham-Denning model provides a formal framework for managing access control in secure systems. Its eight operations, four for entity lifecycle management and four for access right management, establish clear rules for how subjects, objects, and permissions are created, modified, and revoked.

The concepts that matter most are the ones a well-written scenario is likely to probe: the distinction between ownership and delegated rights, and between rights granted with and without the transfer attribute. These ideas run through every modern IAM platform, cloud service, and enterprise security architecture, usually without the model’s name attached.

For exam success, remember that Graham-Denning is about access control management, who can grant and revoke permissions, rather than the access rules themselves. When a scenario involves creating accounts, delegating authority, or auditing permissions, Graham-Denning is your answer.

The fastest way to make that stick is repetition under exam conditions: our LSM CISSP practice tests include Domain 3 model-identification questions that force you to separate Graham-Denning from Bell-LaPadula, Biba, and Clark-Wilson at speed.

Quick Reference for the CISSP Exam

The Graham-Denning model defines how access control is managed in secure systems, specifying eight fundamental operations for creating, managing, and controlling access to objects and subjects.

Core Components

• Subjects: active entities that perform actions (users, processes, applications)
• Objects: passive resources that are accessed (files, databases, printers)
• Access rights: permissions that subjects hold over objects, tracked in an access control matrix

The Eight Operations

1. Create object: establish a new object in the system
2. Delete object: remove an object from the system
3. Create subject: establish a new subject in the system
4. Delete subject: remove a subject from the system
5. Read access right: check a subject’s current rights over an object
6. Grant access right: give a right to another subject
7. Delete access right: remove a right from another subject
8. Transfer access right: pass a right, with delegation ability, to another subject

Control Rights

• Owner: full control over an object, including granting and revoking access
• Transfer attribute: can be attached to any right to enable delegation
• Rights with transfer: recipient can pass the right to others
• Rights without transfer: recipient cannot delegate further

Common Exam Mistakes

• Confusing Read Access Right with reading object content (it checks permissions, not data)
• Assuming transfer means permanent delegation (the owner retains ultimate control)
• Mixing up Graham-Denning with confidentiality or integrity models
• Forgetting that ownership originates from creating the object

Exam Focus: The “Rights to Rights” Logic

Domain 3 tests your ability to categorise models. Bell-LaPadula and Biba are static, rule-based models: they do not care how you got a permission, only that you have it. Graham-Denning is a dynamic, state-transition model: it is entirely about how permissions change.

1. The meta-access trigger. If a question is about “access to access”, it is almost always Graham-Denning. A user blocked from reading a file: Bell-LaPadula or Biba. A user blocked from granting a colleague the ability to read a file: Graham-Denning.

2. Grant vs transfer. Grant: subject A gives subject B a right (sharing a document). Transfer: subject A gives subject B a right plus the ability to give it to subject C (adding an editor who can add other editors). Keywords: “delegated authority”, “propagation of rights”, “transitive trust”.

3. The manager takeaway. As a security manager, you use Graham-Denning thinking when designing provisioning and deprovisioning workflows: create and delete operations map to your joiner, mover, leaver (JML) process, and grant and transfer operations map to your access request and approval workflow.

Bottom line: other models define what access is allowed. Graham-Denning defines who has the authority to grant or change that access.