Mandatory Access Control (MAC)

Under Mandatory Access Control, the system decides. Every object carries a security label (its classification, and often compartments), every subject carries a clearance, and the operating system compares the two on each access under a central policy. Crucially, users cannot override it: the owner of a Top Secret file has no power to hand it to an uncleared colleague, because sharing decisions belong to the policy, not the owner.

MAC is the enforcement machinery that models like Bell-LaPadula, with its No Read Up and No Write Down rules, and Biba assume. Its opposite is discretionary access control, where owners grant access as they see fit. SELinux and classified military systems are the standard real-world examples; the price of MAC’s rigour is administrative overhead, which is why it stays rare outside high-security environments.

Exam relevance: the keywords are labels, clearances, and “users cannot change permissions”. If the file owner can share the file, it is not MAC. Expect direct contrast questions against DAC and role-based access control, and remember MAC’s model pedigree: lattice-based, tied to Bell-LaPadula and Biba.