Access control is the security discipline that decides who or what can reach a given resource and what actions they are allowed to take on it. It works by tying three steps together: it confirms a claimed identity (authentication), checks that identity against a policy to decide what is permitted (authorization), and then enforces the decision and records it (accounting). Access control governs files, databases, networks, and physical spaces alike, and the principle of least privilege keeps every grant as narrow as possible. It is the most failure-prone area of web security: broken access control is the number one risk in the OWASP Top 10 for 2025.
What Is Access Control?
Access control is the set of rules and mechanisms that regulate who can access a resource and what operations they may perform on it. It combines identification, authentication, and authorization into one enforced policy. The system first establishes who is asking, then decides what that requester is allowed to do, and finally permits or blocks the action.
The National Institute of Standards and Technology (NIST) defines access control as the process of granting or denying specific requests to obtain and use information and related services. It applies to data, applications, networks, and physical locations, and it enforces the boundary between an authenticated identity and the resources that identity is permitted to use.
What Is the AAA Framework in Access Control?
AAA stands for authentication, authorization, and accounting, the three ordered functions that make up access control. Each step depends on the one before it, so a request flows through all three in sequence:
- Authentication: verify the claimed identity using a factor such as a password, passkey, or biometric.
- Authorization: check that verified identity against the policy to decide which resources and actions are permitted.
- Accounting: log the request, the identity behind it, and the grant or deny decision for audit and accountability.
Authentication answers who you are, authorization answers what you may do, and accounting answers what was actually done. The boundary between the first two is covered in detail in how authentication and authorization divide the access process.
What Role Does Authentication Play in Access Control?
Authentication establishes the identity that access control then evaluates against a permission policy. No access decision is possible until the system knows who is requesting, so authentication is the first link in every access chain.
- Identification. The requester states a claimed identity, such as a username or a device certificate.
- Authentication. The system verifies that claim through a password, passkey, or biometric factor.
- Authorization. It checks the verified identity against the access policy for the requested resource.
- Enforcement and accounting. The system grants or denies the operation and records the decision for audit.
The strength of every access decision rests on the strength of authentication, because a policy can only be as trustworthy as the identity it is applied to. The methods that prove identity are covered in what authentication is.
What Are the Access Control Models?
The four access control models are Discretionary, Mandatory, Role-Based, and Attribute-Based access control, and each assigns permissions by a different rule. The model an organization chooses sets the trade-off between flexibility and central control.
Each model trades flexibility against central control. The comparison table later in this article sets out how each one assigns permissions and where it fits.
What Is Discretionary Access Control?
Discretionary Access Control (DAC) is a model where the resource owner sets the permissions for that resource. The owner grants or revokes access at their own discretion, which is where the name comes from.
- Owner control: the user who owns a file assigns read, write, and execute rights to others.
- Flexibility: sharing is fast and local, which suits personal and small-team use.
- Weakness: policy becomes inconsistent at scale, because any owner can share a resource with anyone, making central enforcement hard.
What Is Mandatory Access Control?
Mandatory Access Control (MAC) is a model where a central authority assigns security labels that the system enforces regardless of owner preference. Users cannot override the labels, which makes it the strictest of the four models.
- Labels and clearances: resources carry a classification (such as confidential, secret, top secret) and users carry a matching clearance.
- Matched access: a request succeeds only when the user’s clearance matches the resource’s classification.
- Where it runs: government, military, and high-security systems, often through implementations such as SELinux.
What Is Role-Based Access Control?
Role-Based Access Control (RBAC) is a model that grants permissions to roles, and users receive access by holding an assigned role. Permissions attach to the role, not to each individual, which is what makes it scale.
- Roles group permissions: a role such as accountant or administrator bundles the rights a job function needs.
- Assignment grants access: a user inherits the permissions of every role they hold.
- Central updates: changing a role updates access for every user in it at once, which cuts administrative effort at scale.
RBAC is the default model in most enterprise applications and cloud platforms, because new users inherit access through roles instead of one-off grants.
What Is Attribute-Based Access Control?
Attribute-Based Access Control (ABAC) is a model that grants access by evaluating attributes of the user, resource, action, and context at the moment of each request. NIST SP 800-162 is the guide that defines it, and it notes that an access decision can change between requests as attribute values change.
- User attributes: department, clearance, and job title.
- Resource attributes: classification, owner, and data type.
- Contextual attributes: time of day, location, and device security posture.
- Policy rules: combine attributes into conditions, such as granting access only to finance staff on managed devices during business hours.
ABAC supports fine-grained, context-aware decisions that fixed roles cannot express. The added power raises policy complexity, which makes it best suited to dynamic environments rather than simple permission sets.
What Is the Principle of Least Privilege?
The principle of least privilege states that each user, process, or system should receive only the minimum access required to perform its function, and nothing more. It is the governing principle behind every access control model, because it limits the damage a compromised account can cause.
Why Is Broken Access Control the Top Web Security Risk?
Broken access control is the number one risk in the OWASP Top 10 for 2025, because access policy is easy to state but hard to enforce on every request. When enforcement is missing or wrong, a user can act outside their intended permissions.
- It is everywhere: OWASP found some form of broken access control in every application it tested, which is why it ranks first.
- Common failures: viewing or editing another user’s records by changing an identifier in the request, reaching admin pages without an admin role, or trusting a hidden field the client controls.
- What it leads to: unauthorized disclosure, modification, or destruction of data, and actions taken outside a user’s limits.
- How to prevent it: deny by default, enforce checks on the server for every request, and apply least privilege so a flaw exposes as little as possible.
The lesson is that defining a policy is not the same as enforcing it. Access control fails when the check is skipped on even one path, which is why server-side enforcement on every object and action matters.
What Is the Difference Between Physical and Logical Access Control?
Physical access control restricts entry to buildings and equipment, while logical access control restricts access to data and systems. The two layers protect different assets, and a complete program needs both.
- Physical: locks, badge readers, biometric scanners, and turnstiles govern entry to spaces.
- Logical: passwords, permissions, and policies govern access to files and applications.
- Combined: the two pair together, since data security depends on protecting the hardware that holds the data.
- Audit: logging records both physical entries and logical access events for accountability.
Logical controls fail if an attacker reaches the physical hardware. A server protected by strong permissions still needs a locked room, because direct hardware access can bypass software controls entirely.
What Is an Access Control List?
An access control list (ACL) is a table that specifies which users or systems can access a resource and what operations they may perform. It attaches permissions directly to the resource, pairing each subject with the rights it is granted.
- Entries: each entry pairs a subject, such as a user or group, with the permissions granted to it.
- File system ACLs: define read, write, and execute rights on files and directories.
- Network ACLs: filter traffic on routers and firewalls by source, destination, and port.
- Order matters: many ACL implementations apply the first matching rule, so rule order changes the outcome.
An access control list is how discretionary access control is implemented at the resource level. A network ACL applies the same logic to traffic, deciding which packets pass based on defined rules.
What Are Examples of Access Control?
Common access control examples include file permissions, network firewalls, building badge systems, and database roles. Each one enforces a permission boundary, whether logical or physical.
- File permissions: grant read, write, and execute access to users and groups on an operating system.
- Database roles: restrict which tables and operations an application account may use.
- Network firewalls: apply access control lists to allow or block traffic between segments.
- Badge systems: enforce physical access control by checking credentials at controlled doors.
These examples span logical and physical control, but they share one principle: a role-based database account and a building badge reader both grant access only to authorized identities for authorized actions.
How Does Access Control Support Accountability?
Access control supports accountability by logging every access decision and tying each action to an authenticated identity. This is the accounting step of the AAA framework, and it turns access events into an evidence trail.
- Audit logs: record each access request, the identity behind it, and the grant or deny decision.
- Identity binding: ties every logged action to a verified user rather than an anonymous request.
- Non-repudiation: prevents a user from denying an action the logs attribute to their identity.
- Forensic review: reconstructs an incident from access logs after a breach or policy violation.
Accountability depends on reliable authentication, because a log entry is only as trustworthy as the identity behind it. Access control and logging together provide the evidence needed for incident investigation and compliance audits.
Access Control Models Comparison
The table below compares the four access control models across how permissions are assigned, who controls them, and typical use.
| Model | Permissions Assigned By | Controlled By | Typical Use |
|---|---|---|---|
| DAC | Resource owner | Individual owners | File systems and shared documents |
| MAC | Security labels | Central authority | Government and military systems |
| RBAC | Assigned roles | Administrators | Enterprise applications |
| ABAC | Evaluated attributes | Policy engine | Dynamic, context-aware access |
Last Thoughts on Access Control
Access control decides who reaches a resource and what they may do with it, enforcing the boundary between an authenticated identity and permitted operations through the AAA sequence of authentication, authorization, and accounting. The four models of Discretionary, Mandatory, Role-Based, and Attribute-Based access control assign permissions by different rules, from owner choice to a policy engine evaluating attributes, while the principle of least privilege keeps every grant as narrow as possible. Physical and logical controls protect different assets, and access control lists attach permissions to individual resources.
The stakes are high, because broken access control is the number one risk in the OWASP Top 10 for 2025, and defining a policy is never the same as enforcing it on every request. Access control depends on authentication to establish identity and underpins the continuous, per-request verification of zero trust security. The hub on cybersecurity situates access control within the wider protection of systems and data.
Key Takeaways:
- Access control regulates who can use a resource and what actions they can perform on it.
- The AAA framework is its backbone: authentication confirms identity, authorization grants permissions, and accounting logs the result.
- The four models are Discretionary (owner-set), Mandatory (labels), Role-Based (roles), and Attribute-Based (attributes), defined for ABAC by NIST SP 800-162.
- The principle of least privilege grants only the minimum access required and is the governing rule behind every model.
- Broken access control is the number one risk in the OWASP Top 10 for 2025, so policy must be enforced on every request.
- Physical access control protects spaces and logical access control protects data; a complete program needs both.
Frequently Asked Questions (FAQs)
What is access control in simple terms?
Access control is the practice of deciding who or what can use a resource and what actions they may take on it. It confirms an identity, checks that identity against a policy, then grants or denies the request and records the result.
What are the four access control models?
The four models are Discretionary Access Control, Mandatory Access Control, Role-Based Access Control, and Attribute-Based Access Control. They differ in who sets permissions, from the resource owner in DAC to a policy engine evaluating attributes in ABAC.
What is the difference between access control and authentication?
Authentication only proves who a user is. Access control is the wider system that uses that confirmed identity to decide what the user may do, enforces the decision, and logs it. Authentication is one step inside access control.
What is the principle of least privilege?
Least privilege gives each user, process, or device only the minimum access needed to do its job, and no more. It limits the damage a compromised account can cause, because the account holds only narrow rights.
Why is broken access control such a common security risk?
OWASP ranks broken access control as the number one web application risk in its 2025 Top 10, and it appeared in some form in every application tested. It is common because policy is easy to state but hard to enforce on every request and object.
What is the difference between RBAC and ABAC?
RBAC grants access through fixed roles a user holds, which is simple and scalable for stable jobs. ABAC grants access by evaluating attributes such as department, device, and time at each request, which is more flexible but more complex to manage.
