Skip to main content
DataRidge
Category: Access Control

Mandatory Access Control

Also known as: MAC, Mandatory Access Control model
Simply put

Mandatory Access Control is a way of controlling who can see or use information in a computer system, where a central authority sets the rules rather than the individual users or data owners. Access is decided based on security classifications assigned to both the people (or programs) requesting access and the resources they want to reach. It is generally considered one of the more stringent and centralized approaches to access control.

Formal definition

Mandatory Access Control (MAC) is an access control model in which a policy is uniformly enforced across all subjects and objects within a system by a central authority, rather than being set at the discretion of individual resource owners. Access decisions are governed by security classifications or labels associated with subjects and objects, and these rules cannot be overridden by ordinary users. As a control model, MAC falls within the scope of information security (confidentiality, integrity, and availability of resources) and is distinct from data governance concerns such as ownership, stewardship, and data lineage. This entry describes the general model only; it does not cover specific implementation schemes, label taxonomies, or how MAC maps to obligations under any particular data protection regime such as the EU GDPR, UK GDPR, or ISO/IEC 27701, and the presence of MAC does not by itself establish or guarantee regulatory compliance.

Why it matters

Mandatory Access Control matters because it removes access decisions from the hands of individual users and data owners and places them with a central authority that enforces a uniform policy across all subjects and objects. In environments where the confidentiality of information must be protected against both accidental disclosure and deliberate misuse, this centralization limits the risk that a well-meaning or careless individual can grant access beyond what the organization's policy permits. MAC is generally considered one of the more stringent access control models for precisely this reason: ordinary users cannot override the rules that govern their access.

For security teams, MAC is a mechanism within the broader discipline of information security, addressing the confidentiality, integrity, and availability of resources. It should not be confused with data governance concerns such as ownership, stewardship, or data lineage, even though those functions may define the classifications that a MAC system enforces. The two areas overlap where classification policy is set, but they remain distinct: governance decides what a resource is and who is accountable for it, while MAC enforces access rules against those classifications at the system level.

It is important to be clear about what MAC does not do. The presence of a Mandatory Access Control model does not by itself establish or guarantee compliance with any particular data protection regime, such as the EU GDPR, UK GDPR, or a standard like ISO/IEC 27701. MAC is a technical control that can contribute to a defensible security posture, but compliance depends on context, jurisdiction, and the full set of controls and accountability evidence an organization can demonstrate.

Who it's relevant to

Security architects and engineers
Those designing access control for systems handling sensitive information may consider MAC where a uniform, centrally enforced policy is required and where discretionary decisions by individual users would introduce unacceptable risk. They should treat MAC as one model among several and evaluate it against the confidentiality, integrity, and availability requirements of the environment.
Information security teams
Teams responsible for enforcing access policy benefit from understanding MAC as a stringent, centralized model in which the authority to grant access sits with a central policy rather than with data owners. This distinction is relevant when reasoning about how access rules are set, enforced, and audited.
Data governance and information governance leads
Governance functions typically define the classifications and ownership that a MAC system then enforces. Understanding where governance ends and access enforcement begins helps avoid conflating the two: governance establishes what a resource is and who is accountable, while MAC applies access rules against those classifications at the system level.
Compliance and data protection officers
Those assessing an organization's control environment should understand that MAC is a technical access control and, on its own, does not demonstrate compliance with any specific data protection regime. Its relevance lies in contributing to a broader, evidence-backed set of controls, not in guaranteeing a regulatory outcome.

Inside MAC

System-Enforced Policy
Under Mandatory Access Control, access decisions are enforced by the operating system or platform according to a centrally defined policy, rather than left to the discretion of individual data owners or users. This distinguishes MAC from Discretionary Access Control (DAC), where resource owners set permissions.
Security Labels and Classifications
Subjects (users, processes) and objects (files, data stores) are assigned security labels or classification levels. Access is granted or denied by comparing the subject's clearance against the object's classification according to the governing policy.
Non-Discretionary Control
Users generally cannot override, delegate, or reassign access rights to resources they use, even resources they create. The authority to define access rules rests with a policy administrator or security authority, not the individual.
Administrative Authority
A designated security administrator or authority defines and maintains the labeling scheme and access rules. This centralization supports demonstrable, consistent enforcement across the environment.
Relationship to Governance and Security
MAC is primarily an information security control addressing confidentiality and, in some implementations, integrity. It can support data governance objectives such as enforcing classification policy, but it does not itself constitute governance activities like ownership, stewardship, lineage, or data quality management.

Common questions

Answers to the questions practitioners most commonly ask about MAC.

Is Mandatory Access Control the same as Role-Based Access Control (RBAC)?
No. Under Mandatory Access Control (MAC), access decisions are governed by a central policy that individual users and even resource owners cannot override, typically through system-enforced labels and clearances. RBAC, by contrast, grants access based on roles assigned to users, and role definitions can generally be administered more flexibly. The two are frequently conflated because both constrain access, but MAC is distinguished by the fact that the policy is imposed by the system rather than left to owner or administrator discretion. In practice, some environments combine models, so treat any specific deployment on its own terms rather than assuming one model implies the other.
Does implementing Mandatory Access Control by itself satisfy data protection compliance obligations?
No. MAC is an information security access-control model addressing confidentiality and, to a degree, integrity. It is one control among many and does not, on its own, demonstrate compliance with any particular legal or standards instrument. Compliance depends on context, jurisdiction, and implementation, and it typically requires additional measures such as a documented lawful basis for processing, retention rules, transfer arrangements, and demonstrable accountability evidence. Access control also sits within information security rather than data governance, so MAC does not address ownership, stewardship, data quality, or lineage. Treat MAC as a technical safeguard, not as a compliance guarantee.
How do you assign and manage labels or classifications in a Mandatory Access Control system?
In a MAC model, subjects (such as users or processes) and objects (such as files or records) generally carry security attributes, often called labels or classifications, that the system compares against a central policy to permit or deny access. Assigning these labels typically requires a defined classification scheme, consistent labeling procedures, and governance over who may set or change a label, since users normally cannot alter them at will. This entry does not prescribe a specific labeling taxonomy or classification scheme; the design should reflect your organization's data classification policy and the capabilities of the enforcing platform.
What evidence should be retained to demonstrate that Mandatory Access Control is operating as intended?
Because accountability under governance frameworks generally requires demonstrable evidence rather than stated intent, organizations typically retain documentation of the enforced policy, the classification scheme, records of label assignments and changes, and logs of access decisions and denials. Such records support internal review and external assurance. This entry does not cover specific retention periods or which regulatory instrument, if any, mandates particular records, as those depend on jurisdiction and the applicable regime.
How does Mandatory Access Control typically interact with other access-control models in a deployment?
MAC is often layered with other models rather than used in isolation. For example, a system may enforce a mandatory policy that no user can override while also applying role-based or discretionary controls within the boundaries the mandatory policy permits. The practical effect is that the most restrictive applicable control generally governs a given access decision. This entry does not prescribe a specific combination; the appropriate layering depends on the platform, the sensitivity of the data, and organizational policy.
What operational challenges commonly arise when maintaining a Mandatory Access Control model?
Common challenges typically include keeping the classification scheme consistent as data volumes grow, managing the review and change of labels through controlled processes, handling exceptions without undermining the mandatory nature of the policy, and ensuring that label assignment scales with the enforcing platform. Because users generally cannot adjust labels themselves, administrative and governance overhead is often significant. This entry does not evaluate specific products or quantify operational effort, which vary by environment and implementation.

Common misconceptions

Mandatory Access Control and Role-Based Access Control (RBAC) are the same thing.
They are distinct models. MAC enforces access through system-controlled security labels and a centrally defined policy that users cannot override. RBAC grants access based on assigned roles and is typically administered more flexibly. An environment may combine models, but they are not interchangeable.
Under MAC, the person who creates a file can grant others access to it.
MAC is non-discretionary. Unlike Discretionary Access Control, the resource creator generally cannot delegate or reassign access. Access is determined by the centrally defined policy comparing subject clearance to object classification.
Deploying MAC by itself makes an organization compliant with data protection obligations.
MAC is one access control mechanism and does not, on its own, guarantee compliance. It does not address lawful basis, retention, cross-border transfer, or the accountability evidence that governance frameworks require. Compliance depends on context, jurisdiction, and overall implementation.

Best practices

Define and document a clear classification and labeling scheme for both subjects and objects before enforcement, and keep it under the control of a designated security authority.
Assign labeling and policy administration to a central authority rather than individual resource owners, consistent with the non-discretionary nature of the model.
Treat MAC as one layer within a broader control set, combining it with other access models and controls where appropriate rather than relying on it in isolation.
Maintain demonstrable evidence of policy definitions, label assignments, and enforcement decisions so that accountability can be evidenced rather than merely asserted.
Distinguish MAC's security role from data governance activities, and coordinate the labeling scheme with governance-owned classification policy where the two overlap.
Periodically review clearances, classifications, and the governing policy to ensure they remain aligned with current requirements and organizational context.