Discretionary Access Control: Owner Discretion

Quick Answer

Discretionary Access Control is the right model because its defining characteristic is exactly what the scenario is asking for: the individuals who create or own a resource are the ones who decide who else gets to access it, rather than that decision being centralized in a role definition or a system-wide policy. In DAC, an owner typically sets permissions like read, write, or execute directly on their own files or resources, most commonly through access control lists that specify which other users or groups can interact with that resource and in what way. This ownership-driven model is what distinguishes DAC from the alternatives: role-based access control ties permissions to a person's job function rather than to individual owner decisions, and mandatory access control removes discretion from users entirely, enforcing access through system-wide security labels that neither the owner nor the user can override. DAC's flexibility is also its main weakness, because access decisions are scattered across many individual owners rather than centrally governed, it's harder to enforce consistent organization-wide policy or guarantee that sensitive data isn't shared inappropriately, which is why more tightly regulated environments often prefer RBAC or MAC instead. When a question describes a scenario where individual data or resource owners are meant to control who can access what they own, that's the hallmark of DAC, and it should be your answer whenever owner discretion, rather than role or classification, is the deciding factor.