Topic starter
06/11/2026 6:36 pm
TL;DR: Mandatory access control only works when the system can reliably tie a session to one verified person, and OLOID’s analysis shows that shared logins and unlocked workstations collapse that assumption by letting the wrong worker inherit labels and clearances. MAC is strongest when paired with per-session authentication, because the policy engine cannot compensate for a false identity at login.
Editorial analysis by NHI Mgmt Group, based on content published by OLOID: “Mandatory Access Control (MAC): How It Works, Examples, and Limitations”.
By the numbers:
- Only 1 in 10 companies had labeled their files in Varonis's 2025 State of Data Security Report.
Key questions
Q: How should teams secure mandatory access control on shared workstations?
A: Secure mandatory access control on shared workstations by binding each user to a named account, enforcing strong authentication, and resetting the session at logout or timeout.
Q: Why do shared logins weaken label-based access control?
A: Shared logins weaken label-based access control because the system can no longer tie a clearance or need-to-know decision to one accountable person.
Q: What is the difference between an access control matrix and role-based access control?
A: An access control matrix assigns permissions directly by subject and object, so every access decision is explicit.
Practitioner guidance
- Enforce per-session authentication on shared terminals Require every shift handoff to end the current session and start a fresh one so the next worker does not inherit clearance from the previous user.
- Separate account identity from workstation access Stop using shared credentials for frontline devices and bind each sign-in to a named worker so labels and clearances apply to the correct person.
- Test MAC against unlocked-session scenarios Validate denied-access cases when a workstation is left open, a user changes mid-shift, or a terminal is shared across roles.
Bottom line: Mandatory access control depends on identity fidelity at the moment of access, not just on well-written policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
MAC is only as strong as the identity session that feeds it. OLOID's analysis shows that the policy engine can enforce labels correctly and still fail operationally when multiple workers share one authenticated account. The control assumes the subject at login remains stable for the duration of the session, which is often false on plant floors and back-office terminals. Practitioners should treat session ownership as part of authorization design, not as an afterthought.
A question worth separating out:
Q: How do access logs lose value in shared-device environments?
A: Access logs lose value in shared-device environments when multiple people act under the same account, so the log shows a workstation and username rather than the real individual. That removes reliable accountability, makes access reviews harder, and weakens investigations unless each user has a unique identity and the device records session start, end, and authentication events.
👉 Read our full editorial: Mandatory access control fails when shared logins break identity