Access control is at the heart of every secure system. Whether you're building a document collaboration tool, a multi-tenant SaaS platform, or a government-grade secure system, choosing the right access control model is a decision that will shape your architecture for years to come.
This guide walks through six mainstream models — ACL, RBAC, ABAC, PBAC, DAC, and MAC — explaining what each one does well, where it falls short, and when to use it.
01 / ACL — Access Control List
The Whitelist Approach
Core Concept
Each resource carries an explicit list of who is allowed to access it. Think of it as a guest list taped to the door of a private event.
Pros
- Resource-level precision
- Simple to implement
Cons
- Fragmented, hard to manage at scale
- No role inheritance or grouping
02 / RBAC — Role-Based Access Control
The Organizational Approach
Core Concept
Permissions are assigned to roles; users inherit permissions by being assigned a role. This is the model most enterprise systems grow into.
Pros
- Clean structure, easy to reason about
- Easy to reuse and maintain
Cons
- Limited fine-grained control
- Not flexible for edge cases
03 / ABAC — Attribute-Based Access Control
The Context-Aware Approach
Core Concept
Access decisions are evaluated dynamically based on attributes of the user, the resource, and the environment. This enables fine-grained, context-sensitive authorization.
Pros
- Highly flexible and expressive
- Dynamic, context-aware decisions
Cons
- Complex to configure and reason about
- Policies can be hard to test and debug
04 / PBAC — Policy-Based Access Control
The Centralized Policy Approach
Core Concept
Access control is governed by centrally managed, reusable policy rules — often written in a dedicated policy language. This enables auditability and consistent enforcement across systems.
Pros
- Centralized, auditable control
- Integrates well with OPA, Casbin, and other policy engines
Cons
- High abstraction barrier
- Hard for non-developers to maintain
05 / DAC — Discretionary Access Control
The Owner-Driven Approach
Core Concept
The owner of a resource decides who can access it, at their own discretion. This is the model behind file permissions in operating systems and sharing features in collaboration tools.
Pros
- Intuitive for users
- Flexible and easy to grant access
Cons
- No centralized policy enforcement
- Risk of accidental over-exposure
06 / MAC — Mandatory Access Control
The Security-First Approach
Core Concept
The system enforces access based on security labels assigned to both users and resources — users cannot override these rules. This is the model used in high-security environments.
Pros
- High security guarantees
- Not dependent on user behavior
Cons
- Inflexible by design
- Unsuitable for most business applications
Quick Reference: Model Comparison
| Model | Control Method | Granularity | Flexibility | Mgmt Complexity | Recommended For |
|---|---|---|---|---|---|
| ACL | Per-resource whitelist | Fine | Medium | Low | Docs & Collaboration |
| RBAC | Role-based inheritance | Medium | Low | Low | Enterprise Systems |
| ABAC | Attribute rule evaluation | Very Fine | High | High | SaaS Dynamic Authz |
| PBAC | Centralized policy language | Any | Very High | Very High | Compliance / Zero-Trust |
| DAC | Owner discretion | Simple | Low | Low | File Systems / Sharing |
| MAC | Security label enforcement | Strict tiers | High | High | Gov / Military / Finance |
Hybrid Patterns: Mixing Models in Practice
In real-world engineering, no single model fits all requirements. The most effective systems layer multiple models to balance structure, flexibility, and security.
ACL + RBAC
Role-based structure for most access, with fine-grained per-resource overrides via ACL. Common in document management and collaboration tools.
RBAC + ABAC
Roles define baseline permissions; attributes enforce dynamic, context-sensitive restrictions on top. Ideal for SaaS platforms with varying tenant rules.
PBAC + ABAC + RBAC
Enterprise-grade combination for large platforms, zero-trust architectures, or multi-tenant systems requiring full auditability and policy governance.
How to Choose: A Decision Guide
Still not sure which model fits your system? Answer these questions to narrow it down:
Are your user roles stable and clearly defined across the system? → Choose RBAC
Do different resources need different access rules (per-file, per-record)? → Choose ACL
Do you need dynamic, context-sensitive access (time, location, device)? → Choose ABAC
Do you need centralized, auditable policies for compliance or zero-trust? → Choose PBAC
Should individual resource owners control their own sharing and access? → Choose DAC
Is the highest security priority — even at the cost of flexibility? → Choose MAC
Access control is never one-size-fits-all. The best systems start with a clear understanding of their security requirements, user workflows, and growth trajectory — then pick the model (or combination of models) that fits. If you're designing a new system, take the time to map out your access patterns before writing a single line of authorization code. Your future self will thank you.