A Discretionary Access Control List is a permissions list tied to an object, where the object owner or authorised administrator decides who may access it. Attackers target weak or excessive entries to read, change or delete data. Defenders should review ownership, inheritance and stale permissions, and remove access that no longer has a business need.
Why Discretionary Access Control Lists change the security posture
A DAC list matters because it turns access into an object-level decision, not a broad system-wide permission. Security teams care when ownership is unclear, inheritance is poorly understood, or old entries linger after a role change. Those conditions create quiet overexposure, and the object owner’s discretion can either contain or widen the blast radius.
For defenders, the practical question is whether the list still reflects the business need behind the object. If the answer is no, the object may be accessible to people, groups, or services that no longer need it, which makes data misuse, unauthorised modification, and accidental deletion much easier.
How weak DAC entries become an attack path
Attackers usually do not need a clever exploit when a DAC list already grants more access than intended. They look for inherited permissions, stale group membership, orphaned object owners, and “temporary” access that never expired. Once they find an object with weak controls, the access path is often straightforward: read sensitive data, alter content, or delete records to disrupt operations.
In practice, the risk is not only direct theft. A mismanaged DAC can also expose service data, configuration files, shared folders, or application content that becomes a stepping stone to further compromise. That is why access review has to consider both the object and the trust relationships around it, not just the visible permission entry.
What security teams should verify before they trust object permissions
Teams should verify who truly owns the object, how inherited rights are applied, and whether direct grants override the intended policy. That includes checking whether access was delegated intentionally or accumulated through group nesting, templates, or legacy administration. A permission that was valid at creation time may be wrong today if the owner changed, the data sensitivity changed, or the object moved across environments.
It also helps to distinguish business necessity from convenience. If a permission exists only because it was easier to copy forward, it is a candidate for removal. If the object is highly sensitive, the acceptable tolerance for inherited or ambiguous access should be much lower than for routine collaboration data.
Risk and Threat Considerations
DAC lists create security exposure when ownership is weak, inheritance is misunderstood, or permissions are left in place longer than the business need that justified them. That combination can quietly expand who can read, change, or remove an object, and the resulting access often looks legitimate until it is abused.
Failure mechanism: Excessive, stale, or inherited entries give an attacker or insider a valid path to data access or destructive action without needing to break the underlying platform.
Impact: The likely outcome is confidentiality loss, integrity loss, or operational disruption, especially when the object contains sensitive records, shared content, or configuration material used by other systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | DAC review depends on current, valid access assignments to objects. |
| AC-6 — Least Privilege | DAC matters because excess object permissions widen the blast radius. | |
| AC-3 — Access Enforcement | DAC is enforced through object-level access decisions and inherited grants. | |
| Recommendation — Review object access assignments and remove stale permissions tied to no longer needed accounts. Limit object permissions to the minimum access required for the business need. Enforce object access decisions consistently, including inherited and delegated permissions. | ||
| NIST CSF 2.0 | PR.AA-04 — Access Permissions and Authorization | DAC directly concerns how permissions are granted and maintained for objects. |
| ID.AM-01 — Physical Devices and Systems Inventoried | Object permission review needs an accurate inventory of protected assets. | |
| Recommendation — Maintain object permissions so only authorised users can access the data. Keep the protected object inventory current so access reviews cover what exists. | ||
Practitioner Guidance
What to prioritise: Start with objects that are both sensitive and heavily shared, because those are the places where stale entries and inherited rights produce the largest blast radius. Review ownership first, then confirm whether each grant still has a current business justification.
What to verify: Check whether the access path is direct, inherited, or group-based, and confirm that removal of one entry does not leave a hidden equivalent path in place. If you cannot explain why an identity can still reach the object, treat the permission as suspect until proven otherwise.
Practitioner takeaway: DAC is only safe when ownership and review discipline are stronger than permission drift, otherwise the list becomes an accumulated record of old trust, not current need.
Related resources from NHI Mgmt Group
- Guide: Authorisation Models Guide
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?
- How should security teams govern API keys used for generative AI access?
- How should security teams use user list views to speed up access reviews without losing control of critical details?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org