Which access control model allows the resource owner to specify which users can access each resource?

• A. Mandatory Access Control
• B. Role-Based Access Control
• C. Attribute-Based Access Control
• D. Discretionary Access Control

Answer: (D)

Discretionary access control is about giving the resource owner the power to decide who can access a resource and what they can do with it. In this model, the owner sets permissions on a per-resource basis—typically using an access control list or similar mechanism—so they can grant or revoke access for specific users or groups. This hands-on control lets the owner tailor access very precisely to each resource, such as allowing one colleague to read a file while another is allowed to edit it.

Contrast this with other models: mandatory access control enforces a central policy based on classifications and clearances, so owners don’t personally grant access. Role-based access control assigns permissions by user roles rather than by individual owner decisions. Attribute-based access control makes access decisions from user, resource, and environment attributes according to policies, not owner permissions. The scenario described aligns with discretionary access control because it centers on the resource owner deciding who can access that particular resource.