Mandatory Access Control

Mandatory Access Control (MAC) is a security model in which a central authority enforces access decisions based on defined security policies and data classifications, rather than allowing individual users or resource owners to decide permissions.

Expanded Explanation

1. Technical Function and Core Characteristics

MAC is a nondiscretionary access control model in which the system enforces access rules based on security labels assigned to users, processes, and resources. It uses centrally defined policies that compare subject clearances and object classifications, often with sensitivity levels and categories, to determine whether access is authorized.

Monitoring-as-Code (MaC) implementations typically prevent users from changing access permissions on resources they own and rely on trusted system mechanisms to enforce policy. Many MaC systems derive from formal models, such as the Bell-LaPadula model for confidentiality, and they often support multilevel security and separation of information domains.

2. Enterprise Usage and Architectural Context

Enterprises use MAC in environments that require strict control of information flow, such as government, defense, and regulated sectors that process classified or highly sensitive data. MaC appears in secure operating systems, databases, virtualization platforms, and container orchestration environments as a control over processes, files, interprocess communication, and network resources.

Architecturally, MaC often operates alongside identity and access management, Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC), with MaC enforcing baseline restrictions that other models cannot override. Security architects integrate MaC with logging, security monitoring, and policy administration tools to maintain verifiable enforcement of confidentiality and integrity requirements.

3. Related or Adjacent Technologies

MAC relates to Discretionary Access Control (DAC), where resource owners can grant permissions, and to RBAC, which bases decisions on user roles. It also aligns with ABAC, which evaluates attributes such as user characteristics, resource labels, and environmental conditions.

Implementations of MaC appear in technologies such as Security-Enhanced Linux (SELinux), AppArmor, and trusted operating systems that support multilevel security. Standards and guidance from organizations such as NIST reference MaC as one of several access control mechanisms that can support compliance with confidentiality, integrity, and information sharing policies.

4. Business and Operational Significance

MAC supports regulatory and policy compliance for organizations that must enforce strict data segregation and information handling rules. It reduces the risk of unauthorized disclosure or modification of sensitive information by limiting what even privileged users and processes can access.

From an operational perspective, MaC can increase administrative overhead because security administrators must define and maintain labels, policies, and clearances in a consistent way. However, it provides predictable, centrally managed enforcement that organizations can align with formal security accreditation, audits, and assurance requirements.