Mandatory access control (MAC) is an access-control policy in which a central authority, not the owner of a resource, decides who may access it and what they may do with it. Users who hold access under MAC cannot simply pass that access on, grant privileges to others, or change the rules that govern it.
What the term means
NIST’s glossary places mandatory access control under the broader idea of nondiscretionary access control. The wording it reproduces from CNSSI 4009-2022 states that access control policy decisions are made by a central authority, not by the individual owner of an object. In other words, the policy is set and enforced by the system or its administrators, and no individual with access can override it on their own authority. (NIST CSRC, mandatory access control glossary entry)
As an Amazon Associate I earn from qualifying purchases.
Two parts of that definition matter in practice. First, the decision belongs to the authority, so the enforcement is uniform across every subject and object the policy covers. Second, the policy can depend on labels: in one formulation the glossary describes, access depends on the sensitivity represented by a label on an information resource and on the user’s formal authorization to access information at that sensitivity.
Free tools Windows power users keep installed
One-click scans. No signup required.
What an authorized user still cannot do
The more distinctive part of MAC is that it limits what a user with legitimate access may do next. The NIST SP 800-53 Rev. 5 definition reproduced in the same glossary entry describes constraints on:
#1 Best Overall
- passing information to other subjects or objects;
- granting privileges to others;
- changing security attributes;
- choosing the security attributes for new or modified objects;
- changing the access-control rules themselves.
That same definition notes that designated trusted subjects may be given defined privileges to perform some of these actions. Trusted roles are therefore not excluded from MAC systems; they are the narrow, deliberately defined exceptions to the constraints above.
How MAC differs from discretionary access control
Discretionary access control (DAC) is the contrasting model. NIST’s DAC glossary entry says that object owners, or another authorized party, can decide who receives access rights and what those rights should be. MAC restricts exactly that capability. The difference is less about whether a rule exists and more about who holds the authority to write and change it.
Rank #2
| Question | Mandatory access control | Discretionary access control |
|---|---|---|
| Who sets access decisions? | A central authority | The object owner or another authorized party |
| Can an authorized user pass access on? | Constrained by the policy | Owner can decide who receives rights |
| Who chooses security attributes for new objects? | Governed by the policy, not the user | Not restricted by a central label policy |
| What does the policy usually evaluate? | Sensitivity labels and formal authorization | Owner-assigned permissions |
These rows describe the policy authority each model contemplates, as NIST’s glossary explains them. They do not describe any specific product, and real systems can combine features from both models.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where attribute-based access control fits
Attribute-based access control (ABAC) is a third category that readers often encounter alongside MAC. NIST SP 800-162 defines ABAC as evaluating attributes of the subject, the object, the operation, and sometimes the environment against policy, rules, or relationships. The publication was first issued in January 2014, and the page at the link below shows an update dated 2019-08-02. (NIST CSRC, SP 800-162 publication page)
The evidence does not establish that MAC and ABAC are mutually exclusive. A system can enforce a central label policy and also evaluate other attributes, so the terms are best treated as describing different axes rather than competing boxes.
A concrete illustration
NIST’s glossary uses a military-security example. An individual data owner does not decide who holds a top-secret clearance, and that owner cannot change an object’s classification from top-secret to secret. The example shows central authority over clearance and classification. It is an illustration of how MAC works, not a statement that every MAC deployment is a military system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Source notes
NIST’s glossary lists several sources for the MAC entry, and their definitions are not identical. The CNSSI 4009-2022 wording stresses central decision-making, the SP 800-44 Version 2 wording stresses labels and clearances, and the SP 800-53 Rev. 5 wording stresses constraints on what subjects can do. Quote the specific source when you rely on a particular sentence.
No named statistic applies to this definition, and no individual’s statement was used.
Best Value
See also the glossary term page itself for current source attributions: mandatory access control glossary entry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
