What is the difference between mandatory access control and discretionary access control?

Mandatory access control is centrally administered, with policy decisions made by security authorities rather than end users. Discretionary access control gives resource owners more freedom to grant or adjust access themselves. MAC offers tighter consistency and governance, while DAC provides flexibility but requires stronger local discipline to avoid permission drift and unintended exposure.

Why This Matters for Security Teams

Mandatory access control, or MAC, and discretionary access control, or DAC, are not just policy labels. They shape how fast access can change, who can approve it, and how much trust is placed in individual users or owners. In NHI environments, that distinction matters because secrets, service accounts, and API keys often spread faster than people expect. The governance challenge is less about convenience and more about whether access changes remain reviewable, consistent, and defensible under pressure.

For security teams, MAC is attractive when the environment needs centralized enforcement, strict classification, and predictable decision-making. DAC can work well in smaller, lower-risk systems, but it often creates uneven controls when resource owners can share credentials or grant access without broader oversight. That is exactly where permission drift starts. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which shows how quickly uncontrolled delegation can become an exposure problem.

Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls and the OWASP Non-Human Identity Top 10 reinforces the same operational point: access decisions must be governable, auditable, and tied to risk. In practice, many security teams encounter privilege sprawl only after a credential has already been reused or shared outside the intended boundary.

How It Works in Practice

MAC means the system enforces access rules centrally, usually based on labels, classifications, or policy tiers. End users and resource owners cannot override those rules on their own. That makes MAC useful where consistency is more important than convenience, especially in regulated or high-impact environments. DAC is the opposite in operational terms: the owner of a file, dataset, service, or application can decide who else gets access. That flexibility is helpful, but it increases the chance that local decisions outpace central governance.

For NHI governance, the difference shows up in how secrets and service accounts are handled. Under a MAC-style model, a security authority can require approved rotation, enforced scopes, and centralized revocation before a credential is usable. Under DAC, the owner of a pipeline or app may distribute API keys directly, bypassing the discipline needed to prevent overexposure. NHIMG’s Ultimate Guide to NHIs, Key Challenges and Risks highlights why that matters: 96% of organisations store secrets outside secrets managers, often in code, config files, or CI/CD tools.

Practitioners usually translate this into a few controls:

• Use MAC where access should be centrally enforced and exceptions must be rare.
• Use DAC only where resource-owner autonomy is acceptable and tightly monitored.
• Treat NHI secrets as governed assets, not shared convenience tokens.
• Pair either model with strong logging, periodic review, and fast revocation.
• Apply least privilege regardless of the model, because overly broad access remains the common failure mode.

In environments with shared infrastructure, cloud automation, or many service accounts, MAC-style central governance usually reduces drift more effectively than owner-driven delegation. These controls tend to break down when teams copy permissions across systems because the original classification and ownership assumptions no longer hold.

Common Variations and Edge Cases

Tighter access control often increases operational overhead, requiring organisations to balance security consistency against the speed that teams need to ship and support systems. That tradeoff becomes sharper when access must be provisioned for temporary jobs, third-party integrations, or autonomous workloads that do not fit neat human-centric approval paths. Best practice is evolving here, and there is no universal standard for every environment.

One common edge case is a hybrid model: central policy defines the boundaries, while owners can request limited exceptions within those boundaries. That is not pure MAC or pure DAC, but it is often how real enterprises operate. Another edge case is cloud IAM, where a team may think it has MAC because policies are centrally managed, yet actual delegation still behaves like DAC when owners can attach permissions freely. The same ambiguity appears with NHI secrets: if teams can mint or share tokens without central controls, the environment behaves more like DAC even if documentation says otherwise.

Security leaders should also distinguish between access to human-owned content and access by machine identities. The latter often needs stronger central control because service accounts and API keys do not self-correct bad decisions. NHIMG’s Ultimate Guide to NHIs, Standards and 52 NHI Breaches Analysis both show that poor governance, not just weak passwords, is what turns flexible access into incident material.

Related resources from NHI Mgmt Group

• What is the difference between reviewing human access and reviewing NHIs?
• What is the difference between role-based access and API key governance for NHI security?
• What is the difference between protecting applications and protecting access?
• What is the difference between using MCP for developer productivity and using it as a governance control?