Discretionary access control lets the owner of a file or a record decide who else may read or change it. The owner grants that access, and the owner can take it back. A central list of job roles is not what makes the decision.
A different model, Role-Based Access Control (RBAC), ignores the owner’s choice and reads the person’s role. The same person can have broad access on one system and almost none on another, depending on which model that system uses.
What the Owner Can Change
- Who may read. The owner names the people or groups that may open the file or the record.
- Who may change. Read access and change access are separate grants.
- Taking it back. The owner can remove a grant without changing anyone’s job title.
Owner Grants and Role Grants
| Compared | Owner Grants | Role Grants |
| Who decides | The owner of the file or the record | The role assigned to the person |
| A job change | Does not, by itself, change the grants | Changing the role changes what the person may open |
| One person’s access | Only what each owner has granted | Whatever the current role allows |