Does discretionary mean optional enforcement?

No. The system enforces permissions; discretion concerns who can determine some of them.

Is an access control list the same as DAC?

No. A list is an implementation mechanism, while DAC describes a policy approach.

Can an organization restrict an owner's sharing choices?

Yes. Discretion can operate within broader technical and organizational restrictions.

AI Glossary / Data governance and quality / Intermediate

Discretionary access control

Definition

Discretionary access control, or DAC, is an approach in which an object's owner or another authorized controller has some discretion to decide who can access that object and what actions they may perform. An object might be a file, folder, or other protected resource. The discretion is exercised within the system's rules; it does not necessarily give an owner unlimited authority to override every organizational security policy.

What it means

The defining question is who can make or delegate an access decision. In a discretionary arrangement, an authorized resource controller can grant another subject permission, such as reading a file. The system still enforces the resulting permissions. DAC is therefore not informal trust or the absence of technical protection. It describes part of the policy model, while an access control list is one mechanism that can represent permissions in an implementation.

How it works

The system identifies the requesting subject and the protected object, then evaluates the requested action against the applicable permissions. An owner or other authorized controller can change certain permissions according to the system's rules. Those permissions may involve individual identities or groups and can interact with inherited settings and other policies. Administrators need visibility into effective access, not merely the most obvious sharing setting. Revocation, ownership transfer, and changes in group membership also require attention over the resource's lifecycle.

Three practical examples

Project files: a document owner gives a colleague read permission while retaining control of who can edit it.
Shared folders: an authorized manager grants a project group access to a working folder under organizational sharing restrictions.
AI collaboration: the controller of an evaluation dataset grants named reviewers access to a limited working copy, with the organization's broader data rules still applying.

Think of it this way

Think of a room custodian who can issue approved keys to selected colleagues, within the building's rules. The custodian has discretion, but the building may still prohibit access to certain areas or types of visitor. The analogy is limited because digital permissions can be inherited, delegated, or combined, and someone who legitimately reads information may be able to copy it beyond the original object's controls.

Worked example

In an original simplified example, a file owner grants Priya read access and Omar read-and-write access. Priya can inspect the file but cannot edit it through those permissions; Omar can do both. Later, Priya joins a group that also has write access. Removing her individual write permission would not resolve the issue because none was individually granted: her effective permission now comes through the group. The team must inspect all relevant grants and the platform's evaluation rules. This is a conceptual illustration, not a universal rule for resolving allow and deny entries, which differs across systems. It shows why an access review needs more than one visible permission row.

Illustrative case study

Fictional example: Birch Labs lets dataset owners share project material with collaborators. A departing employee owns several working folders, and no one has clear responsibility for reviewing their access. The team transfers ownership through its approved process and assigns a regular review owner. It also checks external sharing and group membership. This invented case demonstrates that discretionary sharing needs lifecycle management rather than a one-time decision when the resource is created.

Common misconceptions and mistakes

Do not assume DAC means anyone who can read an object can always change its permissions. The authority to manage access is separate and implementation-dependent. Do not confuse the policy model with a particular operating system's access control list syntax. Also, revoking access to the original object does not necessarily revoke copies already obtained legitimately. Finally, an owner-controlled grant can coexist with centrally imposed restrictions, so actual behavior must be evaluated across the complete policy environment.

Business use

DAC can support flexible collaboration when people closest to a resource understand who needs it. That flexibility creates a need for clear ownership, usable sharing controls, and periodic access review. For AI work, pay particular attention to datasets whose sensitivity differs from ordinary project documents. Define what owners may share, who approves exceptions, and how access ends when a project or relationship finishes. Measure whether effective permissions match current responsibilities rather than treating the presence of an access list as sufficient assurance.

Check your understanding

A reviewer loses a direct access grant but still belongs to an authorized group. Is access necessarily removed?

Answer: No. Effective access may still come from group membership or another applicable grant. Review the complete permission evaluation using the actual platform's rules.

Related terms

Mandatory access control
Attribute-based access control
Access control list
Least privilege
role-based access control
authorization
resource ownership

Learn next

compare discretionary authority with a centrally enforced policy that owners cannot override. Then inspect a harmless sample resource's effective permissions, including groups and inheritance. Document who can read, modify, and change access, since these are distinct capabilities even when one interface presents them together.

Sources

Sources: NIST CSRC, discretionary access control, https://csrc.nist.gov/glossary/term/discretionary_access_control ; NIST IR 7316, Assessment of Access Control Systems, https://csrc.nist.gov/pubs/ir/7316/final ; Microsoft, Dynamic Access Control Glossary, https://learn.microsoft.com/en-us/windows-server/identity/solution-guides/appendix-a--dynamic-access-control-glossary ; NIST Attribute Based Access Control project, https://csrc.nist.gov/Projects/attribute-based-access-control . Relevant primary excerpts were consulted for owner discretion, DACL terminology, and the possibility of combining policy models. Full platform permission algorithms were not reviewed or tested. Examples are original and explicitly simplified.

Previous: Discrete Weibull distribution Next: Discretization